# Flog Txt Version 1 # Analyzer Version: 3.2.2 # Analyzer Build Date: Jun 3 2020 08:38:37 # Log Creation Date: 05.10.2020 07:40:34.174 Process: id = "1" image_name = "fallguysstats.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fallguysstats.exe" page_root = "0x493ec000" os_pid = "0xb50" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x454" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FallGuysStats.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0xb2c [0042.541] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0046.698] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x32eea4 | out: pfEnabled=0x32eea4) returned 0x0 [0046.953] SleepEx (dwMilliseconds=0xb86, bAlertable=1) returned 0x0 [0056.796] SleepEx (dwMilliseconds=0x7d0, bAlertable=1) returned 0x0 [0058.936] EtwEventRegister () returned 0x0 [0058.955] GetCurrentProcess () returned 0xffffffff [0058.956] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x32e024 | out: TokenHandle=0x32e024*=0x214) returned 1 [0058.961] GetTokenInformation (in: TokenHandle=0x214, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x32e024 | out: TokenInformation=0x0, ReturnLength=0x32e024) returned 0 [0058.961] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x73c050 [0058.961] GetTokenInformation (in: TokenHandle=0x214, TokenInformationClass=0x8, TokenInformation=0x73c050, TokenInformationLength=0x4, ReturnLength=0x32e024 | out: TokenInformation=0x73c050, ReturnLength=0x32e024) returned 1 [0058.970] LocalFree (hMem=0x73c050) returned 0x0 [0058.971] DuplicateTokenEx (in: hExistingToken=0x214, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x32e02c | out: phNewToken=0x32e02c*=0x21c) returned 1 [0058.972] CheckTokenMembership (in: TokenHandle=0x21c, SidToCheck=0x29eae20*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x32e03c | out: IsMember=0x32e03c) returned 1 [0058.972] CloseHandle (hObject=0x21c) returned 1 [0060.129] CoTaskMemAlloc (cb=0x20c) returned 0x774bd8 [0060.129] SHGetFolderPathW (in: hwnd=0x0, csidl=7, hToken=0x0, dwFlags=0x0, pszPath=0x774bd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x0 [0060.134] CoTaskMemFree (pv=0x774bd8) [0060.136] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", nBufferLength=0x105, lpBuffer=0x32c3a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpFilePart=0x0) returned 0x5b [0060.138] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FallGuysStats.exe", nBufferLength=0x105, lpBuffer=0x32c3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FallGuysStats.exe", lpFilePart=0x0) returned 0x37 [0060.142] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Chrome updaters.exe", nBufferLength=0x105, lpBuffer=0x32db6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Chrome updaters.exe", lpFilePart=0x0) returned 0x6f [0060.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x32dfcc) returned 1 [0060.143] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Chrome updaters.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\chrome updaters.exe"), fInfoLevelId=0x0, lpFileInformation=0x32e048 | out: lpFileInformation=0x32e048*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0060.144] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x32dfc8) returned 1 [0060.155] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FallGuysStats.exe", nBufferLength=0x105, lpBuffer=0x32db20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FallGuysStats.exe", lpFilePart=0x0) returned 0x37 [0060.155] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Chrome updaters.exe", nBufferLength=0x105, lpBuffer=0x32db20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Chrome updaters.exe", lpFilePart=0x0) returned 0x6f [0060.156] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FallGuysStats.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fallguysstats.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Chrome updaters.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\chrome updaters.exe"), bFailIfExists=1) returned 1 [0060.331] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x32db08, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0060.367] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x32da2c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0060.369] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x32da90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0060.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x32def0) returned 1 [0060.369] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x32df6c | out: lpFileInformation=0x32df6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0cc4300, ftCreationTime.dwHighDateTime=0x1cd5cf4, ftLastAccessTime.dwLowDateTime=0xcf7ee640, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc0cc4300, ftLastWriteTime.dwHighDateTime=0x1cd5cf4, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0060.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x32deec) returned 1 [0064.870] CoTaskMemAlloc (cb=0x20c) returned 0x774bd8 [0064.870] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x774bd8 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0064.870] CoTaskMemFree (pv=0x774bd8) [0064.870] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x32db88, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0064.871] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x32db9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x31 [0064.873] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FallGuysStats.exe", nBufferLength=0x105, lpBuffer=0x32daf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FallGuysStats.exe", lpFilePart=0x0) returned 0x37 [0064.886] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gpustats.bx", nBufferLength=0x105, lpBuffer=0x32da2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gpustats.bx", lpFilePart=0x0) returned 0x3c [0064.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x32df20) returned 1 [0064.887] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gpustats.bx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\gpustats.bx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x214 [0064.888] GetFileType (hFile=0x214) returned 0x1 [0064.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x32df1c) returned 1 [0064.888] GetFileType (hFile=0x214) returned 0x1 [0064.889] WriteFile (in: hFile=0x214, lpBuffer=0x2b057a8*, nNumberOfBytesToWrite=0x4c, lpNumberOfBytesWritten=0x32dfb8, lpOverlapped=0x0 | out: lpBuffer=0x2b057a8*, lpNumberOfBytesWritten=0x32dfb8*=0x4c, lpOverlapped=0x0) returned 1 [0064.890] CloseHandle (hObject=0x214) returned 1 [0064.970] CoTaskMemAlloc (cb=0xd) returned 0x775e08 [0064.971] LoadLibraryA (lpLibFileName="kernel32") returned 0x76d30000 [0064.972] CoTaskMemFree (pv=0x775e08) [0064.984] CoTaskMemAlloc (cb=0x11) returned 0x773338 [0064.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ResumeThread", cchWideChar=12, lpMultiByteStr=0x2b07a30, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ResumeThread", lpUsedDefaultChar=0x0) returned 12 [0064.985] GetProcAddress (hModule=0x76d30000, lpProcName="ResumeThread") returned 0x76d443ef [0064.985] CoTaskMemFree (pv=0x773338) [0064.993] CoTaskMemAlloc (cb=0xd) returned 0x775e68 [0064.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x2b07b38, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0064.993] LoadLibraryA (lpLibFileName="kernel32") returned 0x76d30000 [0064.993] CoTaskMemFree (pv=0x775e68) [0064.993] CoTaskMemAlloc (cb=0x1a) returned 0x7748b8 [0064.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Wow64SetThreadContext", cchWideChar=21, lpMultiByteStr=0x2b07b70, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Wow64SetThreadContext", lpUsedDefaultChar=0x0) returned 21 [0064.994] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64SetThreadContext") returned 0x76dc5393 [0064.994] CoTaskMemFree (pv=0x7748b8) [0065.000] CoTaskMemAlloc (cb=0xd) returned 0x775e08 [0065.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x2b07c74, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0065.001] LoadLibraryA (lpLibFileName="kernel32") returned 0x76d30000 [0065.001] CoTaskMemFree (pv=0x775e08) [0065.001] CoTaskMemAlloc (cb=0x15) returned 0x773338 [0065.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SetThreadContext", cchWideChar=16, lpMultiByteStr=0x2b07cac, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SetThreadContext", lpUsedDefaultChar=0x0) returned 16 [0065.001] GetProcAddress (hModule=0x76d30000, lpProcName="SetThreadContext") returned 0x76dc5393 [0065.001] CoTaskMemFree (pv=0x773338) [0065.003] CoTaskMemAlloc (cb=0xd) returned 0x775e08 [0065.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x2b07dc0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0065.003] LoadLibraryA (lpLibFileName="kernel32") returned 0x76d30000 [0065.003] CoTaskMemFree (pv=0x775e08) [0065.003] CoTaskMemAlloc (cb=0x1a) returned 0x7748b8 [0065.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Wow64GetThreadContext", cchWideChar=21, lpMultiByteStr=0x2b07df8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Wow64GetThreadContext", lpUsedDefaultChar=0x0) returned 21 [0065.003] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64GetThreadContext") returned 0x76d679d4 [0065.004] CoTaskMemFree (pv=0x7748b8) [0065.008] CoTaskMemAlloc (cb=0xd) returned 0x775e08 [0065.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x2b07efc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0065.008] LoadLibraryA (lpLibFileName="kernel32") returned 0x76d30000 [0065.008] CoTaskMemFree (pv=0x775e08) [0065.008] CoTaskMemAlloc (cb=0x15) returned 0x773338 [0065.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetThreadContext", cchWideChar=16, lpMultiByteStr=0x2b07f34, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetThreadContext", lpUsedDefaultChar=0x0) returned 16 [0065.009] GetProcAddress (hModule=0x76d30000, lpProcName="GetThreadContext") returned 0x76d679d4 [0065.009] CoTaskMemFree (pv=0x773338) [0065.010] CoTaskMemAlloc (cb=0xd) returned 0x775e08 [0065.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x2b08024, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0065.010] LoadLibraryA (lpLibFileName="kernel32") returned 0x76d30000 [0065.011] CoTaskMemFree (pv=0x775e08) [0065.011] CoTaskMemAlloc (cb=0x13) returned 0x7732b8 [0065.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VirtualAllocEx", cchWideChar=14, lpMultiByteStr=0x2b0805c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VirtualAllocEx", lpUsedDefaultChar=0x0) returned 14 [0065.011] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualAllocEx") returned 0x76d5d9b0 [0065.011] CoTaskMemFree (pv=0x7732b8) [0065.018] CoTaskMemAlloc (cb=0xd) returned 0x775e68 [0065.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x2b08158, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0065.018] LoadLibraryA (lpLibFileName="kernel32") returned 0x76d30000 [0065.018] CoTaskMemFree (pv=0x775e68) [0065.018] CoTaskMemAlloc (cb=0x17) returned 0x773338 [0065.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WriteProcessMemory", cchWideChar=18, lpMultiByteStr=0x2b08190, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WriteProcessMemory", lpUsedDefaultChar=0x0) returned 18 [0065.018] GetProcAddress (hModule=0x76d30000, lpProcName="WriteProcessMemory") returned 0x76d5d9e0 [0065.018] CoTaskMemFree (pv=0x773338) [0065.023] CoTaskMemAlloc (cb=0xd) returned 0x775e08 [0065.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x2b08294, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0065.023] LoadLibraryA (lpLibFileName="kernel32") returned 0x76d30000 [0065.023] CoTaskMemFree (pv=0x775e08) [0065.023] CoTaskMemAlloc (cb=0x16) returned 0x7732b8 [0065.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ReadProcessMemory", cchWideChar=17, lpMultiByteStr=0x2b082cc, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadProcessMemory", lpUsedDefaultChar=0x0) returned 17 [0065.024] GetProcAddress (hModule=0x76d30000, lpProcName="ReadProcessMemory") returned 0x76d5cfcc [0065.024] CoTaskMemFree (pv=0x7732b8) [0065.027] CoTaskMemAlloc (cb=0xa) returned 0x775e68 [0065.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ntdll", cchWideChar=5, lpMultiByteStr=0x2b0842c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ntdll", lpUsedDefaultChar=0x0) returned 5 [0065.027] LoadLibraryA (lpLibFileName="ntdll") returned 0x77c40000 [0065.027] CoTaskMemFree (pv=0x775e68) [0065.028] CoTaskMemAlloc (cb=0x19) returned 0x7748b8 [0065.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ZwUnmapViewOfSection", cchWideChar=20, lpMultiByteStr=0x2b08458, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ZwUnmapViewOfSection", lpUsedDefaultChar=0x0) returned 20 [0065.028] GetProcAddress (hModule=0x77c40000, lpProcName="ZwUnmapViewOfSection") returned 0x77c5fc70 [0065.028] CoTaskMemFree (pv=0x7748b8) [0065.031] CoTaskMemAlloc (cb=0xd) returned 0x775e68 [0065.031] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x2b08554, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0065.031] LoadLibraryA (lpLibFileName="kernel32") returned 0x76d30000 [0065.032] CoTaskMemFree (pv=0x775e68) [0065.032] CoTaskMemAlloc (cb=0x13) returned 0x7732b8 [0065.032] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateProcessA", cchWideChar=14, lpMultiByteStr=0x2b0858c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateProcessA", lpUsedDefaultChar=0x0) returned 14 [0065.032] GetProcAddress (hModule=0x76d30000, lpProcName="CreateProcessA") returned 0x76d41072 [0065.032] CoTaskMemFree (pv=0x7732b8) [0065.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe", cchWideChar=57, lpMultiByteStr=0x32ded0, cbMultiByte=59, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe²³", lpUsedDefaultChar=0x0) returned 57 [0065.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=0, lpMultiByteStr=0x32decc, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ÐÞ2", lpUsedDefaultChar=0x0) returned 0 [0065.065] CreateProcessA (in: lpApplicationName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe", lpCommandLine="", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000004, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x32df40*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x32e06c | out: lpCommandLine="", lpProcessInformation=0x32e06c*(hProcess=0x244, hThread=0x214, dwProcessId=0x60c, dwThreadId=0x20c)) returned 1 [0065.143] CoTaskMemFree (pv=0x0) [0065.143] GetThreadContext (in: hThread=0x214, lpContext=0x2b08624 | out: lpContext=0x2b08624*(ContextFlags=0x10002, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0xfffde000, Edx=0x0, Ecx=0x0, Eax=0xc0975e, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0065.143] ReadProcessMemory (in: hProcess=0x244, lpBaseAddress=0xfffde008, lpBuffer=0x32e058, nSize=0x4, lpNumberOfBytesRead=0x32e048 | out: lpBuffer=0x32e058*, lpNumberOfBytesRead=0x32e048*=0x4) returned 1 [0065.143] VirtualAllocEx (hProcess=0x244, lpAddress=0x400000, dwSize=0xd8000, flAllocationType=0x3000, flProtect=0x40) returned 0x400000 [0065.149] WriteProcessMemory (in: hProcess=0x244, lpBaseAddress=0x400000, lpBuffer=0x55252d8*, nSize=0x200, lpNumberOfBytesWritten=0x32e048 | out: lpBuffer=0x55252d8*, lpNumberOfBytesWritten=0x32e048*=0x200) returned 1 [0065.182] WriteProcessMemory (in: hProcess=0x244, lpBaseAddress=0x402000, lpBuffer=0x55f68f8*, nSize=0xd0a00, lpNumberOfBytesWritten=0x32e048 | out: lpBuffer=0x55f68f8*, lpNumberOfBytesWritten=0x32e048*=0xd0a00) returned 1 [0065.225] WriteProcessMemory (in: hProcess=0x244, lpBaseAddress=0x4d4000, lpBuffer=0x2b088fc*, nSize=0x800, lpNumberOfBytesWritten=0x32e048 | out: lpBuffer=0x2b088fc*, lpNumberOfBytesWritten=0x32e048*=0x800) returned 1 [0065.247] WriteProcessMemory (in: hProcess=0x244, lpBaseAddress=0x4d6000, lpBuffer=0x2b09108*, nSize=0x200, lpNumberOfBytesWritten=0x32e048 | out: lpBuffer=0x2b09108*, lpNumberOfBytesWritten=0x32e048*=0x200) returned 1 [0065.281] WriteProcessMemory (in: hProcess=0x244, lpBaseAddress=0xfffde008, lpBuffer=0x2b09314*, nSize=0x4, lpNumberOfBytesWritten=0x32e048 | out: lpBuffer=0x2b09314*, lpNumberOfBytesWritten=0x32e048*=0x4) returned 1 [0065.281] SetThreadContext (hThread=0x214, lpContext=0x2b08624*(ContextFlags=0x10002, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0xfffde000, Edx=0x0, Ecx=0x0, Eax=0x4d295e, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0065.282] ResumeThread (hThread=0x214) returned 0x1 [0065.355] CoTaskMemAlloc (cb=0x20c) returned 0x774bd8 [0065.356] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x774bd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x0 [0065.356] CoTaskMemFree (pv=0x774bd8) [0065.356] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x32daf8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpFilePart=0x0) returned 0x2d [0065.451] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\_CL_02f3a8c9sy", nBufferLength=0x105, lpBuffer=0x32da2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\_CL_02f3a8c9sy", lpFilePart=0x0) returned 0x46 [0065.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x32df20) returned 1 [0065.451] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\_CL_02f3a8c9sy" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\_cl_02f3a8c9sy"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x248 [0065.453] GetFileType (hFile=0x248) returned 0x1 [0065.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x32df1c) returned 1 [0065.453] GetFileType (hFile=0x248) returned 0x1 [0065.453] WriteFile (in: hFile=0x248, lpBuffer=0x2b38778*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x32dfb8, lpOverlapped=0x0 | out: lpBuffer=0x2b38778*, lpNumberOfBytesWritten=0x32dfb8*=0x30, lpOverlapped=0x0) returned 1 [0065.454] CloseHandle (hObject=0x248) returned 1 [0065.456] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe", nBufferLength=0x105, lpBuffer=0x32da64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe", lpFilePart=0x0) returned 0x42 [0065.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x32df58) returned 1 [0065.456] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ctfmom.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x248 [0065.457] GetFileType (hFile=0x248) returned 0x1 [0065.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x32df54) returned 1 [0065.457] GetFileType (hFile=0x248) returned 0x1 [0065.462] WriteFile (in: hFile=0x248, lpBuffer=0x56c7318*, nNumberOfBytesToWrite=0x3b800, lpNumberOfBytesWritten=0x32e014, lpOverlapped=0x0 | out: lpBuffer=0x56c7318*, lpNumberOfBytesWritten=0x32e014*=0x3b800, lpOverlapped=0x0) returned 1 [0065.477] CloseHandle (hObject=0x248) returned 1 [0065.482] SleepEx (dwMilliseconds=0x3e8, bAlertable=1) returned 0x0 [0066.488] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0071.855] ShellExecuteExW (in: pExecInfo=0x2b3af94*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x2b3af94*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x3a4)) returned 1 [0079.247] LocalFree (hMem=0x732ae0) returned 0x0 [0079.385] GetFullPathNameW (in: lpFileName="keys.util", nBufferLength=0x105, lpBuffer=0x32da64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\keys.util", lpFilePart=0x0) returned 0x2f [0079.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x32df58) returned 1 [0079.385] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\keys.util" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\keys.util"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3a4 [0079.738] GetFileType (hFile=0x3a4) returned 0x1 [0079.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x32df54) returned 1 [0079.738] GetFileType (hFile=0x3a4) returned 0x1 [0079.738] WriteFile (in: hFile=0x3a4, lpBuffer=0x581ab98*, nNumberOfBytesToWrite=0x8d800, lpNumberOfBytesWritten=0x32e014, lpOverlapped=0x0 | out: lpBuffer=0x581ab98*, lpNumberOfBytesWritten=0x32e014*=0x8d800, lpOverlapped=0x0) returned 1 [0079.801] CloseHandle (hObject=0x3a4) returned 1 [0079.819] GetFullPathNameW (in: lpFileName="keys.util", nBufferLength=0x105, lpBuffer=0x32dba0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\keys.util", lpFilePart=0x0) returned 0x2f [0079.821] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\keys.util", dwFileAttributes=0x2) returned 1 [0080.421] LocalAlloc (uFlags=0x0, uBytes=0x10) returned 0x62cf260 [0080.421] LocalAlloc (uFlags=0x0, uBytes=0x1a) returned 0x62c3a38 [0080.421] ShellExecuteExW (in: pExecInfo=0x297f644*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="cmd.exe", lpParameters="/c keys.util", lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x297f644*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="cmd.exe", lpParameters="/c keys.util", lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x3b8)) returned 1 [0081.790] LocalFree (hMem=0x62cf260) returned 0x0 [0081.790] LocalFree (hMem=0x62c3a38) returned 0x0 [0081.791] CoTaskMemAlloc (cb=0x20c) returned 0x62cecf8 [0081.791] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x62cecf8 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0081.791] CoTaskMemFree (pv=0x62cecf8) [0081.791] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x32db88, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0081.792] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x32db9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x31 [0081.794] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ran.bx", nBufferLength=0x105, lpBuffer=0x32da2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ran.bx", lpFilePart=0x0) returned 0x37 [0081.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x32df20) returned 1 [0081.794] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ran.bx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ran.bx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x210 [0081.795] GetFileType (hFile=0x210) returned 0x1 [0081.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x32df1c) returned 1 [0081.795] GetFileType (hFile=0x210) returned 0x1 [0081.795] WriteFile (in: hFile=0x210, lpBuffer=0x2981acc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x32dfb8, lpOverlapped=0x0 | out: lpBuffer=0x2981acc*, lpNumberOfBytesWritten=0x32dfb8*=0x4, lpOverlapped=0x0) returned 1 [0081.796] CloseHandle (hObject=0x210) returned 1 [0081.806] CoGetContextToken (in: pToken=0x32e8c0 | out: pToken=0x32e8c0) returned 0x0 [0081.806] CObjectContext::QueryInterface () returned 0x0 [0081.806] CObjectContext::GetCurrentThreadType () returned 0x0 [0081.806] Release () returned 0x0 [0081.807] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x13880, cHandles=0x1, pHandles=0x6eaf80*=0xa8, lpdwindex=0x32e764 | out: lpdwindex=0x32e764) returned 0x0 Thread: id = 2 os_tid = 0xb10 Thread: id = 3 os_tid = 0xb14 [0043.531] CoGetContextToken (in: pToken=0xd7f8bc | out: pToken=0xd7f8bc) returned 0x800401f0 [0043.531] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0063.789] CloseHandle (hObject=0x214) returned 1 [0079.356] CloseHandle (hObject=0x3a4) returned 1 [0082.161] EtwEventUnregister () returned 0x0 [0082.163] CloseHandle (hObject=0x3b8) returned 1 [0082.165] SleepEx (dwMilliseconds=0xffffffff, bAlertable=0) Thread: id = 4 os_tid = 0xae8 Thread: id = 5 os_tid = 0xa04 [0080.586] CoGetContextToken (in: pToken=0x122f97c | out: pToken=0x122f97c) returned 0x0 [0080.586] CObjectContext::QueryInterface () returned 0x0 [0080.586] CObjectContext::GetCurrentThreadType () returned 0x0 [0080.586] Release () returned 0x0 Thread: id = 18 os_tid = 0x87c Thread: id = 19 os_tid = 0x89c Thread: id = 29 os_tid = 0xa44 [0082.167] SleepEx (dwMilliseconds=0x14, bAlertable=0) returned 0x0 [0082.319] SleepEx (dwMilliseconds=0x14, bAlertable=0) returned 0x0 [0082.400] SleepEx (dwMilliseconds=0x14, bAlertable=0) returned 0x0 [0082.999] SleepEx (dwMilliseconds=0x14, bAlertable=0) returned 0x0 [0083.289] SleepEx (dwMilliseconds=0x14, bAlertable=0) Thread: id = 30 os_tid = 0x5c4 Process: id = "2" image_name = "msbuild.exe" filename = "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\msbuild.exe" page_root = "0x248d1000" os_pid = "0x60c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xb50" cmd_line = "\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 6 os_tid = 0x20c [0066.071] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0066.250] CoTaskMemAlloc (cb=0x20c) returned 0x757fb0 [0066.251] SHGetFolderPathW (in: hwnd=0x0, csidl=0, hToken=0x0, dwFlags=0x0, pszPath=0x757fb0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x0 [0066.254] CoTaskMemFree (pv=0x757fb0) [0066.257] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x32d6d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0066.260] CoTaskMemAlloc (cb=0x20c) returned 0x757fb0 [0066.260] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x757fb0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned 0x0 [0066.262] CoTaskMemFree (pv=0x757fb0) [0066.262] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x32d6d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", lpFilePart=0x0) returned 0x2b [0066.262] CoTaskMemAlloc (cb=0x20c) returned 0x757fb0 [0066.262] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x757fb0 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0066.263] CoTaskMemFree (pv=0x757fb0) [0066.263] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x32d6d4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0066.263] CoTaskMemAlloc (cb=0x20c) returned 0x757fb0 [0066.263] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x757fb0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x0 [0066.264] CoTaskMemFree (pv=0x757fb0) [0066.264] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x32d6d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpFilePart=0x0) returned 0x2d [0066.264] CoTaskMemAlloc (cb=0x20c) returned 0x757fb0 [0066.264] SHGetFolderPathW (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x757fb0 | out: pszPath="C:\\ProgramData") returned 0x0 [0066.283] CoTaskMemFree (pv=0x757fb0) [0066.284] GetFullPathNameW (in: lpFileName="C:\\ProgramData", nBufferLength=0x105, lpBuffer=0x32d6d4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData", lpFilePart=0x0) returned 0xe [0066.284] CoTaskMemAlloc (cb=0x20c) returned 0x757fb0 [0066.284] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x757fb0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned 0x0 [0066.285] CoTaskMemFree (pv=0x757fb0) [0066.285] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", nBufferLength=0x105, lpBuffer=0x32d6d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", lpFilePart=0x0) returned 0x27 [0066.285] CoTaskMemAlloc (cb=0x20c) returned 0x757fb0 [0066.285] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x757fb0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.286] CoTaskMemFree (pv=0x757fb0) [0066.286] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", nBufferLength=0x105, lpBuffer=0x32d6d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d [0066.288] GetTimeZoneInformation (in: lpTimeZoneInformation=0x32da8c | out: lpTimeZoneInformation=0x32da8c) returned 0x2 [0066.292] GetDynamicTimeZoneInformation (in: pTimeZoneInformation=0x32d8e0 | out: pTimeZoneInformation=0x32d8e0) returned 0x2 [0066.303] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\AUS Eastern Standard Time", ulOptions=0x0, samDesired=0x20019, phkResult=0x32d9c4 | out: phkResult=0x32d9c4*=0x200) returned 0x0 [0066.304] RegQueryValueExW (in: hKey=0x200, lpValueName="TZI", lpReserved=0x0, lpType=0x32d9e0, lpData=0x0, lpcbData=0x32d9dc*=0x0 | out: lpType=0x32d9e0*=0x3, lpData=0x0, lpcbData=0x32d9dc*=0x2c) returned 0x0 [0066.304] RegQueryValueExW (in: hKey=0x200, lpValueName="TZI", lpReserved=0x0, lpType=0x32d9e0, lpData=0x268877c, lpcbData=0x32d9dc*=0x2c | out: lpType=0x32d9e0*=0x3, lpData=0x268877c*, lpcbData=0x32d9dc*=0x2c) returned 0x0 [0066.304] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\AUS Eastern Standard Time\\Dynamic DST", ulOptions=0x0, samDesired=0x20019, phkResult=0x32d818 | out: phkResult=0x32d818*=0x204) returned 0x0 [0066.305] RegQueryValueExW (in: hKey=0x204, lpValueName="FirstEntry", lpReserved=0x0, lpType=0x32d834, lpData=0x0, lpcbData=0x32d830*=0x0 | out: lpType=0x32d834*=0x4, lpData=0x0, lpcbData=0x32d830*=0x4) returned 0x0 [0066.305] RegQueryValueExW (in: hKey=0x204, lpValueName="FirstEntry", lpReserved=0x0, lpType=0x32d834, lpData=0x32d820, lpcbData=0x32d830*=0x4 | out: lpType=0x32d834*=0x4, lpData=0x32d820*=0x7d7, lpcbData=0x32d830*=0x4) returned 0x0 [0066.305] RegQueryValueExW (in: hKey=0x204, lpValueName="LastEntry", lpReserved=0x0, lpType=0x32d834, lpData=0x0, lpcbData=0x32d830*=0x0 | out: lpType=0x32d834*=0x4, lpData=0x0, lpcbData=0x32d830*=0x4) returned 0x0 [0066.305] RegQueryValueExW (in: hKey=0x204, lpValueName="LastEntry", lpReserved=0x0, lpType=0x32d834, lpData=0x32d820, lpcbData=0x32d830*=0x4 | out: lpType=0x32d834*=0x4, lpData=0x32d820*=0x7d8, lpcbData=0x32d830*=0x4) returned 0x0 [0066.305] RegQueryValueExW (in: hKey=0x204, lpValueName="2007", lpReserved=0x0, lpType=0x32d834, lpData=0x0, lpcbData=0x32d830*=0x0 | out: lpType=0x32d834*=0x3, lpData=0x0, lpcbData=0x32d830*=0x2c) returned 0x0 [0066.305] RegQueryValueExW (in: hKey=0x204, lpValueName="2007", lpReserved=0x0, lpType=0x32d834, lpData=0x2688de0, lpcbData=0x32d830*=0x2c | out: lpType=0x32d834*=0x3, lpData=0x2688de0*, lpcbData=0x32d830*=0x2c) returned 0x0 [0066.305] RegQueryValueExW (in: hKey=0x204, lpValueName="2008", lpReserved=0x0, lpType=0x32d834, lpData=0x0, lpcbData=0x32d830*=0x0 | out: lpType=0x32d834*=0x3, lpData=0x0, lpcbData=0x32d830*=0x2c) returned 0x0 [0066.306] RegQueryValueExW (in: hKey=0x204, lpValueName="2008", lpReserved=0x0, lpType=0x32d834, lpData=0x2688ea0, lpcbData=0x32d830*=0x2c | out: lpType=0x32d834*=0x3, lpData=0x2688ea0*, lpcbData=0x32d830*=0x2c) returned 0x0 [0066.306] RegCloseKey (hKey=0x204) returned 0x0 [0066.306] RegQueryValueExW (in: hKey=0x200, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x32d9b8, lpData=0x0, lpcbData=0x32d9b4*=0x0 | out: lpType=0x32d9b8*=0x1, lpData=0x0, lpcbData=0x32d9b4*=0x20) returned 0x0 [0066.307] RegQueryValueExW (in: hKey=0x200, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x32d9b8, lpData=0x2688fe8, lpcbData=0x32d9b4*=0x20 | out: lpType=0x32d9b8*=0x1, lpData="@tzres.dll,-670", lpcbData=0x32d9b4*=0x20) returned 0x0 [0066.307] RegQueryValueExW (in: hKey=0x200, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x32d9b8, lpData=0x0, lpcbData=0x32d9b4*=0x0 | out: lpType=0x32d9b8*=0x1, lpData=0x0, lpcbData=0x32d9b4*=0x20) returned 0x0 [0066.307] RegQueryValueExW (in: hKey=0x200, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x32d9b8, lpData=0x2689040, lpcbData=0x32d9b4*=0x20 | out: lpType=0x32d9b8*=0x1, lpData="@tzres.dll,-672", lpcbData=0x32d9b4*=0x20) returned 0x0 [0066.307] RegQueryValueExW (in: hKey=0x200, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x32d9b8, lpData=0x0, lpcbData=0x32d9b4*=0x0 | out: lpType=0x32d9b8*=0x1, lpData=0x0, lpcbData=0x32d9b4*=0x20) returned 0x0 [0066.307] RegQueryValueExW (in: hKey=0x200, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x32d9b8, lpData=0x2689098, lpcbData=0x32d9b4*=0x20 | out: lpType=0x32d9b8*=0x1, lpData="@tzres.dll,-671", lpcbData=0x32d9b4*=0x20) returned 0x0 [0066.308] CoTaskMemAlloc (cb=0x20c) returned 0x759b00 [0066.308] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x759b00 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0066.308] CoTaskMemFree (pv=0x759b00) [0066.309] CoTaskMemAlloc (cb=0x20c) returned 0x759b00 [0066.309] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x32d9d4, pwszFileMUIPath=0x759b00, pcchFileMUIPath=0x32d9d8, pululEnumerator=0x32d9cc | out: pwszLanguage=0x0, pcchLanguage=0x32d9d4, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x32d9d8, pululEnumerator=0x32d9cc) returned 1 [0066.589] CoTaskMemFree (pv=0x0) [0066.590] CoTaskMemFree (pv=0x759b00) [0066.590] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x3e0001 [0066.595] CoTaskMemAlloc (cb=0x3ec) returned 0x759b00 [0066.595] LoadStringW (in: hInstance=0x3e0001, uID=0x29e, lpBuffer=0x759b00, cchBufferMax=500 | out: lpBuffer="(UTC+10:00) Canberra, Melbourne, Sydney") returned 0x27 [0066.595] CoTaskMemFree (pv=0x759b00) [0066.595] FreeLibrary (hLibModule=0x3e0001) returned 1 [0066.596] CoTaskMemAlloc (cb=0x20c) returned 0x759b00 [0066.596] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x759b00 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0066.596] CoTaskMemFree (pv=0x759b00) [0066.596] CoTaskMemAlloc (cb=0x20c) returned 0x759b00 [0066.596] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x32d9d4, pwszFileMUIPath=0x759b00, pcchFileMUIPath=0x32d9d8, pululEnumerator=0x32d9cc | out: pwszLanguage=0x0, pcchLanguage=0x32d9d4, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x32d9d8, pululEnumerator=0x32d9cc) returned 1 [0066.597] CoTaskMemFree (pv=0x0) [0066.597] CoTaskMemFree (pv=0x759b00) [0066.597] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x3e0001 [0066.598] CoTaskMemAlloc (cb=0x3ec) returned 0x759b00 [0066.598] LoadStringW (in: hInstance=0x3e0001, uID=0x2a0, lpBuffer=0x759b00, cchBufferMax=500 | out: lpBuffer="AUS Eastern Standard Time") returned 0x19 [0066.598] CoTaskMemFree (pv=0x759b00) [0066.598] FreeLibrary (hLibModule=0x3e0001) returned 1 [0066.598] CoTaskMemAlloc (cb=0x20c) returned 0x759b00 [0066.598] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x759b00 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0066.599] CoTaskMemFree (pv=0x759b00) [0066.599] CoTaskMemAlloc (cb=0x20c) returned 0x759b00 [0066.599] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x32d9d4, pwszFileMUIPath=0x759b00, pcchFileMUIPath=0x32d9d8, pululEnumerator=0x32d9cc | out: pwszLanguage=0x0, pcchLanguage=0x32d9d4, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x32d9d8, pululEnumerator=0x32d9cc) returned 1 [0066.599] CoTaskMemFree (pv=0x0) [0066.599] CoTaskMemFree (pv=0x759b00) [0066.599] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x3e0001 [0066.600] CoTaskMemAlloc (cb=0x3ec) returned 0x759b00 [0066.600] LoadStringW (in: hInstance=0x3e0001, uID=0x29f, lpBuffer=0x759b00, cchBufferMax=500 | out: lpBuffer="AUS Eastern Daylight Time") returned 0x19 [0066.600] CoTaskMemFree (pv=0x759b00) [0066.600] FreeLibrary (hLibModule=0x3e0001) returned 1 [0066.601] RegCloseKey (hKey=0x200) returned 0x0 [0066.706] CoTaskMemAlloc (cb=0x20c) returned 0x75f300 [0066.707] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x75f300 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0066.707] CoTaskMemFree (pv=0x75f300) [0066.707] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x32d764, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0066.708] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x32d778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x31 [0066.709] CoTaskMemAlloc (cb=0x20c) returned 0x75f300 [0066.709] GetEnvironmentVariableW (in: lpName="Temp", lpBuffer=0x75f300, nSize=0x104 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x24 [0066.709] CoTaskMemFree (pv=0x75f300) [0066.709] GetUserNameW (in: lpBuffer=0x32da10, pcbBuffer=0x32dc88 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x32dc88) returned 1 [0066.737] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x32d5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0066.738] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x32d654, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0066.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x32dab4) returned 1 [0066.739] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x32db30 | out: lpFileInformation=0x32db30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0cc4300, ftCreationTime.dwHighDateTime=0x1cd5cf4, ftLastAccessTime.dwLowDateTime=0xcf7ee640, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc0cc4300, ftLastWriteTime.dwHighDateTime=0x1cd5cf4, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0066.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x32dab0) returned 1 [0066.811] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x32d83c | out: pfEnabled=0x32d83c) returned 0x0 [0066.921] GetComputerNameW (in: lpBuffer=0x32da10, nSize=0x32dc88 | out: lpBuffer="XDUWTFONO", nSize=0x32dc88) returned 1 [0066.922] GetComputerNameW (in: lpBuffer=0x32da10, nSize=0x32dc88 | out: lpBuffer="XDUWTFONO", nSize=0x32dc88) returned 1 [0066.922] CoTaskMemAlloc (cb=0x20c) returned 0x7653b8 [0066.922] GetEnvironmentVariableW (in: lpName="Temp", lpBuffer=0x7653b8, nSize=0x104 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x24 [0066.922] CoTaskMemFree (pv=0x7653b8) [0066.922] GetUserNameW (in: lpBuffer=0x32da10, pcbBuffer=0x32dc88 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x32dc88) returned 1 [0066.923] GetComputerNameW (in: lpBuffer=0x32da10, nSize=0x32dc88 | out: lpBuffer="XDUWTFONO", nSize=0x32dc88) returned 1 [0066.924] CoTaskMemAlloc (cb=0x20c) returned 0x765528 [0066.924] GetEnvironmentVariableW (in: lpName="windir", lpBuffer=0x765528, nSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0066.924] CoTaskMemFree (pv=0x765528) [0066.924] CoTaskMemAlloc (cb=0x20c) returned 0x765528 [0066.924] GetEnvironmentVariableW (in: lpName="windir", lpBuffer=0x765528, nSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0066.924] CoTaskMemFree (pv=0x765528) [0067.044] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe", nBufferLength=0x105, lpBuffer=0x32ee84, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe", lpFilePart=0x0) returned 0x39 [0067.044] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe", nBufferLength=0x105, lpBuffer=0x32edfc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe", lpFilePart=0x0) returned 0x39 [0067.053] VirtualProtect (in: lpAddress=0x4d294e, dwSize=0xb, flNewProtect=0x40, lpflOldProtect=0x32f420 | out: lpflOldProtect=0x32f420*=0x40) returned 1 [0067.066] VirtualProtect (in: lpAddress=0x4d2942, dwSize=0xb, flNewProtect=0x40, lpflOldProtect=0x32f420 | out: lpflOldProtect=0x32f420*=0x40) returned 1 [0067.079] VirtualProtect (in: lpAddress=0x400178, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x32f420 | out: lpflOldProtect=0x32f420*=0x40) returned 1 [0067.092] VirtualProtect (in: lpAddress=0x4001a0, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x32f420 | out: lpflOldProtect=0x32f420*=0x40) returned 1 [0067.105] VirtualProtect (in: lpAddress=0x4001c8, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x32f420 | out: lpflOldProtect=0x32f420*=0x40) returned 1 [0067.119] VirtualProtect (in: lpAddress=0x402008, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x32f420 | out: lpflOldProtect=0x32f420*=0x40) returned 1 [0067.136] VirtualProtect (in: lpAddress=0x4188f8, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x32f420 | out: lpflOldProtect=0x32f420*=0x40) returned 1 [0067.150] VirtualProtect (in: lpAddress=0x418918, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x32f420 | out: lpflOldProtect=0x32f420*=0x40) returned 1 [0067.162] VirtualProtect (in: lpAddress=0x418920, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x32f420 | out: lpflOldProtect=0x32f420*=0x40) returned 1 [0067.174] VirtualProtect (in: lpAddress=0x418924, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x32f420 | out: lpflOldProtect=0x32f420*=0x40) returned 1 [0067.188] VirtualProtect (in: lpAddress=0x41892c, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x32f420 | out: lpflOldProtect=0x32f420*=0x40) returned 1 [0067.200] VirtualProtect (in: lpAddress=0x418930, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x32f420 | out: lpflOldProtect=0x32f420*=0x40) returned 1 [0067.216] VirtualProtect (in: lpAddress=0x418934, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x32f420 | out: lpflOldProtect=0x32f420*=0x40) returned 1 [0067.239] VirtualProtect (in: lpAddress=0x418938, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x32f420 | out: lpflOldProtect=0x32f420*=0x40) returned 1 [0067.252] VirtualProtect (in: lpAddress=0x418940, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x32f420 | out: lpflOldProtect=0x32f420*=0x40) returned 1 [0067.264] VirtualProtect (in: lpAddress=0x418944, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x32f420 | out: lpflOldProtect=0x32f420*=0x40) returned 1 [0067.277] VirtualProtect (in: lpAddress=0x41894c, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x32f420 | out: lpflOldProtect=0x32f420*=0x40) returned 1 [0067.289] VirtualProtect (in: lpAddress=0x418950, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x32f420 | out: lpflOldProtect=0x32f420*=0x40) returned 1 [0067.302] VirtualProtect (in: lpAddress=0x418954, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x32f420 | out: lpflOldProtect=0x32f420*=0x40) returned 1 [0067.317] VirtualProtect (in: lpAddress=0x41895c, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x32f420 | out: lpflOldProtect=0x32f420*=0x40) returned 1 [0067.331] VirtualProtect (in: lpAddress=0x418960, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x32f420 | out: lpflOldProtect=0x32f420*=0x40) returned 1 [0067.380] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x32de58 | out: phkResult=0x32de58*=0x0) returned 0x2 [0067.392] EtwEventRegister () returned 0x0 [0067.672] EtwEventRegister () returned 0x0 Thread: id = 7 os_tid = 0x7c4 Thread: id = 8 os_tid = 0x5d4 [0066.082] CoGetContextToken (in: pToken=0x485f6ec | out: pToken=0x485f6ec) returned 0x0 [0066.083] CObjectContext::QueryInterface () returned 0x0 [0066.083] CObjectContext::GetCurrentThreadType () returned 0x0 [0066.083] Release () returned 0x0 [0066.083] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 9 os_tid = 0x138 Thread: id = 10 os_tid = 0x5cc [0067.712] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0067.713] CoGetContextToken (in: pToken=0x549fd14 | out: pToken=0x549fd14) returned 0x0 [0067.713] CObjectContext::QueryInterface () returned 0x0 [0067.713] CObjectContext::GetCurrentThreadType () returned 0x0 [0067.713] Release () returned 0x0 [0067.713] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0067.713] CoUninitialize () [0067.925] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0067.927] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0067.928] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0067.930] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0067.954] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0068.001] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0068.008] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0068.009] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0068.009] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0068.012] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0068.022] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0068.045] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0068.047] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0068.048] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0068.049] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0068.050] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0068.051] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0068.051] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0068.052] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0068.054] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0068.055] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0068.056] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0068.094] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0068.104] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0068.110] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0068.112] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0068.117] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0068.118] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0068.119] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0068.127] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0068.141] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0068.151] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0068.154] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0068.156] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0068.170] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0068.171] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0068.172] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0068.174] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0068.176] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0068.188] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0068.203] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0068.204] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0068.206] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0068.209] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0068.210] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0068.212] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0068.241] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0068.242] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0068.243] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0068.244] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0068.904] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x298) returned 0x0 [0068.905] RegQueryInfoKeyW (in: hKey=0x298, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x549f864, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x549f860, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x549f864*=0x2f, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x549f860*=0x0, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.905] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x0, lpName=0x26c4bc0, lpcchName=0x549f880, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="AddressBook", lpcchName=0x549f880, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.905] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x1, lpName=0x26c4bc0, lpcchName=0x549f880, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Adobe Flash Player Plugin", lpcchName=0x549f880, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.905] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x2, lpName=0x26c4bc0, lpcchName=0x549f880, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Connection Manager", lpcchName=0x549f880, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.905] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x3, lpName=0x26c4bc0, lpcchName=0x549f880, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="DirectDrawEx", lpcchName=0x549f880, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.905] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x4, lpName=0x26c4bc0, lpcchName=0x549f880, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Fontcore", lpcchName=0x549f880, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.905] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x5, lpName=0x26c4bc0, lpcchName=0x549f880, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Google Chrome", lpcchName=0x549f880, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.905] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x6, lpName=0x26c4bc0, lpcchName=0x549f880, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IE40", lpcchName=0x549f880, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.906] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x7, lpName=0x26c4bc0, lpcchName=0x549f880, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IE4Data", lpcchName=0x549f880, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.906] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x8, lpName=0x26c4bc0, lpcchName=0x549f880, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IE5BAKEX", lpcchName=0x549f880, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.906] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x9, lpName=0x26c4bc0, lpcchName=0x549f880, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IEData", lpcchName=0x549f880, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.906] RegEnumKeyExW (in: hKey=0x298, dwIndex=0xa, lpName=0x26c4bc0, lpcchName=0x549f880, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="MobileOptionPack", lpcchName=0x549f880, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.906] RegEnumKeyExW (in: hKey=0x298, dwIndex=0xb, lpName=0x26c4bc0, lpcchName=0x549f880, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Mozilla Firefox 25.0 (x86 en-US)", lpcchName=0x549f880, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.906] RegEnumKeyExW (in: hKey=0x298, dwIndex=0xc, lpName=0x26c4bc0, lpcchName=0x549f880, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="MozillaMaintenanceService", lpcchName=0x549f880, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.906] RegEnumKeyExW (in: hKey=0x298, dwIndex=0xd, lpName=0x26c4bc0, lpcchName=0x549f880, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="SchedulingAgent", lpcchName=0x549f880, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.906] RegEnumKeyExW (in: hKey=0x298, dwIndex=0xe, lpName=0x26c4bc0, lpcchName=0x549f880, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="WIC", lpcchName=0x549f880, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.906] RegEnumKeyExW (in: hKey=0x298, dwIndex=0xf, lpName=0x26c4bc0, lpcchName=0x549f880, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}", lpcchName=0x549f880, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.906] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x10, lpName=0x26c4bc0, lpcchName=0x549f880, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757", lpcchName=0x549f880, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.906] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x11, lpName=0x26c4bc0, lpcchName=0x549f880, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173", lpcchName=0x549f880, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.906] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x12, lpName=0x26c4bc0, lpcchName=0x549f880, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860", lpcchName=0x549f880, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.906] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x13, lpName=0x26c4bc0, lpcchName=0x549f880, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655", lpcchName=0x549f880, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.906] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x14, lpName=0x26c4bc0, lpcchName=0x549f880, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743", lpcchName=0x549f880, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.907] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x15, lpName=0x26c4bc0, lpcchName=0x549f880, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063", lpcchName=0x549f880, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.907] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x16, lpName=0x26c4bc0, lpcchName=0x549f880, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573", lpcchName=0x549f880, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.907] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x17, lpName=0x26c4bc0, lpcchName=0x549f880, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{26A24AE4-039D-4CA4-87B4-2F83217045FF}", lpcchName=0x549f880, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.907] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x18, lpName=0x26c4bc0, lpcchName=0x549f880, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpcchName=0x549f880, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.907] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x19, lpName=0x26c4bc0, lpcchName=0x549f880, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpcchName=0x549f880, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.907] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x1a, lpName=0x26c4bc0, lpcchName=0x549f880, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{4A03706F-666A-4037-7777-5F2748764D10}", lpcchName=0x549f880, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.907] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x1b, lpName=0x26c4bc0, lpcchName=0x549f880, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{582EA838-9199-3518-A05C-DB09462F68EC}", lpcchName=0x549f880, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.907] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x1c, lpName=0x26c4bc0, lpcchName=0x549f880, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{68306422-7C57-373F-8860-D26CE4BA2A15}", lpcchName=0x549f880, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.907] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x1d, lpName=0x26c4bc0, lpcchName=0x549f880, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}", lpcchName=0x549f880, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.907] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x1e, lpName=0x26c4bc0, lpcchName=0x549f880, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{9BE518E6-ECC6-35A9-88E4-87755C07200F}", lpcchName=0x549f880, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.907] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x1f, lpName=0x26c4bc0, lpcchName=0x549f880, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{AC76BA86-7AD7-FFFF-7B44-AA0000000001}", lpcchName=0x549f880, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.907] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x20, lpName=0x26c4bc0, lpcchName=0x549f880, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{B175520C-86A2-35A7-8619-86DC379688B9}", lpcchName=0x549f880, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.907] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x21, lpName=0x26c4bc0, lpcchName=0x549f880, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}", lpcchName=0x549f880, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.908] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x22, lpName=0x26c4bc0, lpcchName=0x549f880, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpcchName=0x549f880, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.908] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x23, lpName=0x26c4bc0, lpcchName=0x549f880, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{e52a6842-b0ac-476e-b48f-378a97a67346}", lpcchName=0x549f880, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.908] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x24, lpName=0x26c4bc0, lpcchName=0x549f880, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpcchName=0x549f880, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.908] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x25, lpName=0x26c4bc0, lpcchName=0x549f880, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}", lpcchName=0x549f880, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.908] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x26, lpName=0x26c4bc0, lpcchName=0x549f880, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757", lpcchName=0x549f880, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.908] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x27, lpName=0x26c4bc0, lpcchName=0x549f880, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173", lpcchName=0x549f880, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.908] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x28, lpName=0x26c4bc0, lpcchName=0x549f880, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860", lpcchName=0x549f880, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.908] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x29, lpName=0x26c4bc0, lpcchName=0x549f880, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655", lpcchName=0x549f880, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.908] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x2a, lpName=0x26c4bc0, lpcchName=0x549f880, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743", lpcchName=0x549f880, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.908] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x2b, lpName=0x26c4bc0, lpcchName=0x549f880, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063", lpcchName=0x549f880, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.908] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x2c, lpName=0x26c4bc0, lpcchName=0x549f880, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573", lpcchName=0x549f880, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.908] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x2d, lpName=0x26c4bc0, lpcchName=0x549f880, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{f325f05b-f963-4640-a43b-c8a494cdda0f}", lpcchName=0x549f880, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.908] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x2e, lpName=0x26c4bc0, lpcchName=0x549f880, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}", lpcchName=0x549f880, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0068.909] RegOpenKeyExW (in: hKey=0x298, lpSubKey="AddressBook", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x294) returned 0x0 [0068.909] RegQueryValueExW (in: hKey=0x294, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.909] RegQueryValueExW (in: hKey=0x294, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.909] RegOpenKeyExW (in: hKey=0x298, lpSubKey="Adobe Flash Player Plugin", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x29c) returned 0x0 [0068.909] RegQueryValueExW (in: hKey=0x29c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x1, lpData=0x0, lpcbData=0x549f858*=0x3a) returned 0x0 [0068.909] RegQueryValueExW (in: hKey=0x29c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x26c5ec8, lpcbData=0x549f858*=0x3a | out: lpType=0x549f85c*=0x1, lpData="Adobe Flash Player 10 Plugin", lpcbData=0x549f858*=0x3a) returned 0x0 [0068.909] RegQueryValueExW (in: hKey=0x29c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x1, lpData=0x0, lpcbData=0x549f858*=0x18) returned 0x0 [0068.909] RegQueryValueExW (in: hKey=0x29c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x26c5f58, lpcbData=0x549f858*=0x18 | out: lpType=0x549f85c*=0x1, lpData="10.3.183.75", lpcbData=0x549f858*=0x18) returned 0x0 [0068.909] RegOpenKeyExW (in: hKey=0x298, lpSubKey="Connection Manager", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x2a0) returned 0x0 [0068.910] RegQueryValueExW (in: hKey=0x2a0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.910] RegQueryValueExW (in: hKey=0x2a0, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.910] RegOpenKeyExW (in: hKey=0x298, lpSubKey="DirectDrawEx", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x2a4) returned 0x0 [0068.910] RegQueryValueExW (in: hKey=0x2a4, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.910] RegQueryValueExW (in: hKey=0x2a4, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.910] RegOpenKeyExW (in: hKey=0x298, lpSubKey="Fontcore", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x2a8) returned 0x0 [0068.910] RegQueryValueExW (in: hKey=0x2a8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.910] RegQueryValueExW (in: hKey=0x2a8, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.910] RegOpenKeyExW (in: hKey=0x298, lpSubKey="Google Chrome", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x2ac) returned 0x0 [0068.910] RegQueryValueExW (in: hKey=0x2ac, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x1, lpData=0x0, lpcbData=0x549f858*=0x1c) returned 0x0 [0068.910] RegQueryValueExW (in: hKey=0x2ac, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x26c63d8, lpcbData=0x549f858*=0x1c | out: lpType=0x549f85c*=0x1, lpData="Google Chrome", lpcbData=0x549f858*=0x1c) returned 0x0 [0068.910] RegQueryValueExW (in: hKey=0x2ac, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x1, lpData=0x0, lpcbData=0x549f858*=0x1c) returned 0x0 [0068.911] RegQueryValueExW (in: hKey=0x2ac, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x26c6428, lpcbData=0x549f858*=0x1c | out: lpType=0x549f85c*=0x1, lpData="58.0.3029.110", lpcbData=0x549f858*=0x1c) returned 0x0 [0068.911] RegOpenKeyExW (in: hKey=0x298, lpSubKey="IE40", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x2b0) returned 0x0 [0068.911] RegQueryValueExW (in: hKey=0x2b0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.911] RegQueryValueExW (in: hKey=0x2b0, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.911] RegOpenKeyExW (in: hKey=0x298, lpSubKey="IE4Data", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x2b4) returned 0x0 [0068.911] RegQueryValueExW (in: hKey=0x2b4, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.911] RegQueryValueExW (in: hKey=0x2b4, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.911] RegOpenKeyExW (in: hKey=0x298, lpSubKey="IE5BAKEX", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x2b8) returned 0x0 [0068.911] RegQueryValueExW (in: hKey=0x2b8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.911] RegQueryValueExW (in: hKey=0x2b8, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.911] RegOpenKeyExW (in: hKey=0x298, lpSubKey="IEData", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x2bc) returned 0x0 [0068.912] RegQueryValueExW (in: hKey=0x2bc, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.912] RegQueryValueExW (in: hKey=0x2bc, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.912] RegOpenKeyExW (in: hKey=0x298, lpSubKey="MobileOptionPack", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x2c0) returned 0x0 [0068.912] RegQueryValueExW (in: hKey=0x2c0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.912] RegQueryValueExW (in: hKey=0x2c0, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.912] RegOpenKeyExW (in: hKey=0x298, lpSubKey="Mozilla Firefox 25.0 (x86 en-US)", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x2c4) returned 0x0 [0068.912] RegQueryValueExW (in: hKey=0x2c4, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x1, lpData=0x0, lpcbData=0x549f858*=0x42) returned 0x0 [0068.912] RegQueryValueExW (in: hKey=0x2c4, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x26c6a4c, lpcbData=0x549f858*=0x42 | out: lpType=0x549f85c*=0x1, lpData="Mozilla Firefox 25.0 (x86 en-US)", lpcbData=0x549f858*=0x42) returned 0x0 [0068.912] RegQueryValueExW (in: hKey=0x2c4, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x1, lpData=0x0, lpcbData=0x549f858*=0xa) returned 0x0 [0068.912] RegQueryValueExW (in: hKey=0x2c4, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x26c6aec, lpcbData=0x549f858*=0xa | out: lpType=0x549f85c*=0x1, lpData="25.0", lpcbData=0x549f858*=0xa) returned 0x0 [0068.912] RegOpenKeyExW (in: hKey=0x298, lpSubKey="MozillaMaintenanceService", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x2c8) returned 0x0 [0068.913] RegQueryValueExW (in: hKey=0x2c8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x1, lpData=0x0, lpcbData=0x549f858*=0x38) returned 0x0 [0068.913] RegQueryValueExW (in: hKey=0x2c8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x26c6c80, lpcbData=0x549f858*=0x38 | out: lpType=0x549f85c*=0x1, lpData="Mozilla Maintenance Service", lpcbData=0x549f858*=0x38) returned 0x0 [0068.913] RegQueryValueExW (in: hKey=0x2c8, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x1, lpData=0x0, lpcbData=0x549f858*=0xa) returned 0x0 [0068.913] RegQueryValueExW (in: hKey=0x2c8, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x26c6d08, lpcbData=0x549f858*=0xa | out: lpType=0x549f85c*=0x1, lpData="25.0", lpcbData=0x549f858*=0xa) returned 0x0 [0068.913] RegOpenKeyExW (in: hKey=0x298, lpSubKey="SchedulingAgent", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x2cc) returned 0x0 [0068.913] RegQueryValueExW (in: hKey=0x2cc, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.913] RegQueryValueExW (in: hKey=0x2cc, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.913] RegOpenKeyExW (in: hKey=0x298, lpSubKey="WIC", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x2d0) returned 0x0 [0068.913] RegQueryValueExW (in: hKey=0x2d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.913] RegQueryValueExW (in: hKey=0x2d0, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.913] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x2d4) returned 0x0 [0068.913] RegQueryValueExW (in: hKey=0x2d4, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x1, lpData=0x0, lpcbData=0x549f858*=0x76) returned 0x0 [0068.914] RegQueryValueExW (in: hKey=0x2d4, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x26c707c, lpcbData=0x549f858*=0x76 | out: lpType=0x549f85c*=0x1, lpData="Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005", lpcbData=0x549f858*=0x76) returned 0x0 [0068.914] RegQueryValueExW (in: hKey=0x2d4, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x1, lpData=0x0, lpcbData=0x549f858*=0x16) returned 0x0 [0068.914] RegQueryValueExW (in: hKey=0x2d4, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x26c7184, lpcbData=0x549f858*=0x16 | out: lpType=0x549f85c*=0x1, lpData="12.0.21005", lpcbData=0x549f858*=0x16) returned 0x0 [0068.914] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x2d8) returned 0x0 [0068.914] RegQueryValueExW (in: hKey=0x2d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.914] RegQueryValueExW (in: hKey=0x2d8, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.914] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x2dc) returned 0x0 [0068.914] RegQueryValueExW (in: hKey=0x2dc, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.914] RegQueryValueExW (in: hKey=0x2dc, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.914] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x2e0) returned 0x0 [0068.914] RegQueryValueExW (in: hKey=0x2e0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.915] RegQueryValueExW (in: hKey=0x2e0, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.915] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x2e4) returned 0x0 [0068.915] RegQueryValueExW (in: hKey=0x2e4, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.915] RegQueryValueExW (in: hKey=0x2e4, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.915] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x2e8) returned 0x0 [0068.915] RegQueryValueExW (in: hKey=0x2e8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.915] RegQueryValueExW (in: hKey=0x2e8, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.915] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x2ec) returned 0x0 [0068.915] RegQueryValueExW (in: hKey=0x2ec, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.915] RegQueryValueExW (in: hKey=0x2ec, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.915] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x2f0) returned 0x0 [0068.916] RegQueryValueExW (in: hKey=0x2f0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.916] RegQueryValueExW (in: hKey=0x2f0, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.916] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{26A24AE4-039D-4CA4-87B4-2F83217045FF}", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x2f4) returned 0x0 [0068.916] RegQueryValueExW (in: hKey=0x2f4, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x1, lpData=0x0, lpcbData=0x549f858*=0x22) returned 0x0 [0068.916] RegQueryValueExW (in: hKey=0x2f4, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x26c7c20, lpcbData=0x549f858*=0x22 | out: lpType=0x549f85c*=0x1, lpData="Java 7 Update 45", lpcbData=0x549f858*=0x22) returned 0x0 [0068.916] RegQueryValueExW (in: hKey=0x2f4, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x1, lpData=0x0, lpcbData=0x549f858*=0x10) returned 0x0 [0068.916] RegQueryValueExW (in: hKey=0x2f4, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x26c7c80, lpcbData=0x549f858*=0x10 | out: lpType=0x549f85c*=0x1, lpData="7.0.450", lpcbData=0x549f858*=0x10) returned 0x0 [0068.916] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x2f8) returned 0x0 [0068.916] RegQueryValueExW (in: hKey=0x2f8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x1, lpData=0x0, lpcbData=0x549f858*=0x7a) returned 0x0 [0068.916] RegQueryValueExW (in: hKey=0x2f8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x26c7e1c, lpcbData=0x549f858*=0x7a | out: lpType=0x549f85c*=0x1, lpData="Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030", lpcbData=0x549f858*=0x7a) returned 0x0 [0068.916] RegQueryValueExW (in: hKey=0x2f8, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x1, lpData=0x0, lpcbData=0x549f858*=0x1a) returned 0x0 [0068.916] RegQueryValueExW (in: hKey=0x2f8, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x26c7f2c, lpcbData=0x549f858*=0x1a | out: lpType=0x549f85c*=0x1, lpData="11.0.61030.0", lpcbData=0x549f858*=0x1a) returned 0x0 [0068.917] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{3c3aafc8-d898-43ec-998f-965ffdae065a}", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x2fc) returned 0x0 [0068.917] RegQueryValueExW (in: hKey=0x2fc, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x1, lpData=0x0, lpcbData=0x549f858*=0x7a) returned 0x0 [0068.917] RegQueryValueExW (in: hKey=0x2fc, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x26c8140, lpcbData=0x549f858*=0x7a | out: lpType=0x549f85c*=0x1, lpData="Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501", lpcbData=0x549f858*=0x7a) returned 0x0 [0068.917] RegQueryValueExW (in: hKey=0x2fc, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x1, lpData=0x0, lpcbData=0x549f858*=0x1a) returned 0x0 [0068.917] RegQueryValueExW (in: hKey=0x2fc, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x26c8250, lpcbData=0x549f858*=0x1a | out: lpType=0x549f85c*=0x1, lpData="12.0.30501.0", lpcbData=0x549f858*=0x1a) returned 0x0 [0068.917] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{4A03706F-666A-4037-7777-5F2748764D10}", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x300) returned 0x0 [0068.917] RegQueryValueExW (in: hKey=0x300, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x1, lpData=0x0, lpcbData=0x549f858*=0x24) returned 0x0 [0068.917] RegQueryValueExW (in: hKey=0x300, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x26c8464, lpcbData=0x549f858*=0x24 | out: lpType=0x549f85c*=0x1, lpData="Java Auto Updater", lpcbData=0x549f858*=0x24) returned 0x0 [0068.917] RegQueryValueExW (in: hKey=0x300, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x1, lpData=0x0, lpcbData=0x549f858*=0x10) returned 0x0 [0068.918] RegQueryValueExW (in: hKey=0x300, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x26c84c4, lpcbData=0x549f858*=0x10 | out: lpType=0x549f85c*=0x1, lpData="2.1.9.8", lpcbData=0x549f858*=0x10) returned 0x0 [0068.918] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{582EA838-9199-3518-A05C-DB09462F68EC}", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x304) returned 0x0 [0068.918] RegQueryValueExW (in: hKey=0x304, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x1, lpData=0x0, lpcbData=0x549f858*=0x78) returned 0x0 [0068.918] RegQueryValueExW (in: hKey=0x304, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x26c86ac, lpcbData=0x549f858*=0x78 | out: lpType=0x549f85c*=0x1, lpData="Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017", lpcbData=0x549f858*=0x78) returned 0x0 [0068.918] RegQueryValueExW (in: hKey=0x304, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x1, lpData=0x0, lpcbData=0x549f858*=0x18) returned 0x0 [0068.918] RegQueryValueExW (in: hKey=0x304, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x26c87b4, lpcbData=0x549f858*=0x18 | out: lpType=0x549f85c*=0x1, lpData="14.10.25017", lpcbData=0x549f858*=0x18) returned 0x0 [0068.918] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{68306422-7C57-373F-8860-D26CE4BA2A15}", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x308) returned 0x0 [0068.918] RegQueryValueExW (in: hKey=0x308, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x1, lpData=0x0, lpcbData=0x549f858*=0x7e) returned 0x0 [0068.918] RegQueryValueExW (in: hKey=0x308, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x26c89bc, lpcbData=0x549f858*=0x7e | out: lpType=0x549f85c*=0x1, lpData="Microsoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017", lpcbData=0x549f858*=0x7e) returned 0x0 [0068.918] RegQueryValueExW (in: hKey=0x308, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x1, lpData=0x0, lpcbData=0x549f858*=0x18) returned 0x0 [0068.918] RegQueryValueExW (in: hKey=0x308, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x26c8ad4, lpcbData=0x549f858*=0x18 | out: lpType=0x549f85c*=0x1, lpData="14.10.25017", lpcbData=0x549f858*=0x18) returned 0x0 [0068.919] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x30c) returned 0x0 [0068.919] RegQueryValueExW (in: hKey=0x30c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x1, lpData=0x0, lpcbData=0x549f858*=0x54) returned 0x0 [0068.919] RegQueryValueExW (in: hKey=0x30c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x26c8ce4, lpcbData=0x549f858*=0x54 | out: lpType=0x549f85c*=0x1, lpData="Microsoft Visual C++ 2005 Redistributable", lpcbData=0x549f858*=0x54) returned 0x0 [0068.919] RegQueryValueExW (in: hKey=0x30c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x1, lpData=0x0, lpcbData=0x549f858*=0x14) returned 0x0 [0068.919] RegQueryValueExW (in: hKey=0x30c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x26c8da4, lpcbData=0x549f858*=0x14 | out: lpType=0x549f85c*=0x1, lpData="8.0.61001", lpcbData=0x549f858*=0x14) returned 0x0 [0068.919] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{9BE518E6-ECC6-35A9-88E4-87755C07200F}", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x310) returned 0x0 [0068.919] RegQueryValueExW (in: hKey=0x310, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x1, lpData=0x0, lpcbData=0x549f858*=0x7e) returned 0x0 [0068.919] RegQueryValueExW (in: hKey=0x310, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x26c8f7c, lpcbData=0x549f858*=0x7e | out: lpType=0x549f85c*=0x1, lpData="Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161", lpcbData=0x549f858*=0x7e) returned 0x0 [0068.919] RegQueryValueExW (in: hKey=0x310, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x1, lpData=0x0, lpcbData=0x549f858*=0x1e) returned 0x0 [0068.919] RegQueryValueExW (in: hKey=0x310, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x26c9094, lpcbData=0x549f858*=0x1e | out: lpType=0x549f85c*=0x1, lpData="9.0.30729.6161", lpcbData=0x549f858*=0x1e) returned 0x0 [0068.919] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{AC76BA86-7AD7-FFFF-7B44-AA0000000001}", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x314) returned 0x0 [0068.920] RegQueryValueExW (in: hKey=0x314, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x1, lpData=0x0, lpcbData=0x549f858*=0x26) returned 0x0 [0068.920] RegQueryValueExW (in: hKey=0x314, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x26c92b8, lpcbData=0x549f858*=0x26 | out: lpType=0x549f85c*=0x1, lpData="Adobe Reader X MUI", lpcbData=0x549f858*=0x26) returned 0x0 [0068.920] RegQueryValueExW (in: hKey=0x314, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x1, lpData=0x0, lpcbData=0x549f858*=0xe) returned 0x0 [0068.920] RegQueryValueExW (in: hKey=0x314, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x26c9320, lpcbData=0x549f858*=0xe | out: lpType=0x549f85c*=0x1, lpData="10.0.0", lpcbData=0x549f858*=0xe) returned 0x0 [0068.920] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{B175520C-86A2-35A7-8619-86DC379688B9}", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x318) returned 0x0 [0068.920] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x1, lpData=0x0, lpcbData=0x549f858*=0x7c) returned 0x0 [0068.920] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x26c94bc, lpcbData=0x549f858*=0x7c | out: lpType=0x549f85c*=0x1, lpData="Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030", lpcbData=0x549f858*=0x7c) returned 0x0 [0068.920] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x1, lpData=0x0, lpcbData=0x549f858*=0x16) returned 0x0 [0068.920] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x26c95cc, lpcbData=0x549f858*=0x16 | out: lpType=0x549f85c*=0x1, lpData="11.0.61030", lpcbData=0x549f858*=0x16) returned 0x0 [0068.920] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x31c) returned 0x0 [0068.920] RegQueryValueExW (in: hKey=0x31c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x1, lpData=0x0, lpcbData=0x549f858*=0x76) returned 0x0 [0068.920] RegQueryValueExW (in: hKey=0x31c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x26c97d8, lpcbData=0x549f858*=0x76 | out: lpType=0x549f85c*=0x1, lpData="Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030", lpcbData=0x549f858*=0x76) returned 0x0 [0068.921] RegQueryValueExW (in: hKey=0x31c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x1, lpData=0x0, lpcbData=0x549f858*=0x16) returned 0x0 [0068.921] RegQueryValueExW (in: hKey=0x31c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x26c98e0, lpcbData=0x549f858*=0x16 | out: lpType=0x549f85c*=0x1, lpData="11.0.61030", lpcbData=0x549f858*=0x16) returned 0x0 [0068.929] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x320) returned 0x0 [0068.929] RegQueryValueExW (in: hKey=0x320, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x1, lpData=0x0, lpcbData=0x549f858*=0x7a) returned 0x0 [0068.929] RegQueryValueExW (in: hKey=0x320, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x26ca1e8, lpcbData=0x549f858*=0x7a | out: lpType=0x549f85c*=0x1, lpData="Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030", lpcbData=0x549f858*=0x7a) returned 0x0 [0068.929] RegQueryValueExW (in: hKey=0x320, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x1, lpData=0x0, lpcbData=0x549f858*=0x1a) returned 0x0 [0068.929] RegQueryValueExW (in: hKey=0x320, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x26ca2f8, lpcbData=0x549f858*=0x1a | out: lpType=0x549f85c*=0x1, lpData="11.0.61030.0", lpcbData=0x549f858*=0x1a) returned 0x0 [0068.929] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{e52a6842-b0ac-476e-b48f-378a97a67346}", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x324) returned 0x0 [0068.929] RegQueryValueExW (in: hKey=0x324, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x1, lpData=0x0, lpcbData=0x549f858*=0x7c) returned 0x0 [0068.929] RegQueryValueExW (in: hKey=0x324, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x26ca598, lpcbData=0x549f858*=0x7c | out: lpType=0x549f85c*=0x1, lpData="Microsoft Visual C++ 2017 Redistributable (x64) - 14.10.25017", lpcbData=0x549f858*=0x7c) returned 0x0 [0068.929] RegQueryValueExW (in: hKey=0x324, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x1, lpData=0x0, lpcbData=0x549f858*=0x1c) returned 0x0 [0068.930] RegQueryValueExW (in: hKey=0x324, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x26ca6a8, lpcbData=0x549f858*=0x1c | out: lpType=0x549f85c*=0x1, lpData="14.10.25017.0", lpcbData=0x549f858*=0x1c) returned 0x0 [0068.930] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x328) returned 0x0 [0068.930] RegQueryValueExW (in: hKey=0x328, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x1, lpData=0x0, lpcbData=0x549f858*=0x7a) returned 0x0 [0068.930] RegQueryValueExW (in: hKey=0x328, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x26ca8c0, lpcbData=0x549f858*=0x7a | out: lpType=0x549f85c*=0x1, lpData="Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501", lpcbData=0x549f858*=0x7a) returned 0x0 [0068.930] RegQueryValueExW (in: hKey=0x328, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x1, lpData=0x0, lpcbData=0x549f858*=0x1a) returned 0x0 [0068.930] RegQueryValueExW (in: hKey=0x328, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x26ca9d0, lpcbData=0x549f858*=0x1a | out: lpType=0x549f85c*=0x1, lpData="12.0.30501.0", lpcbData=0x549f858*=0x1a) returned 0x0 [0068.930] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x32c) returned 0x0 [0068.930] RegQueryValueExW (in: hKey=0x32c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x1, lpData=0x0, lpcbData=0x549f858*=0x78) returned 0x0 [0068.930] RegQueryValueExW (in: hKey=0x32c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x26cabe4, lpcbData=0x549f858*=0x78 | out: lpType=0x549f85c*=0x1, lpData="Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219", lpcbData=0x549f858*=0x78) returned 0x0 [0068.930] RegQueryValueExW (in: hKey=0x32c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x1, lpData=0x0, lpcbData=0x549f858*=0x16) returned 0x0 [0068.930] RegQueryValueExW (in: hKey=0x32c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x26cacec, lpcbData=0x549f858*=0x16 | out: lpType=0x549f85c*=0x1, lpData="10.0.40219", lpcbData=0x549f858*=0x16) returned 0x0 [0068.930] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x330) returned 0x0 [0068.931] RegQueryValueExW (in: hKey=0x330, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.931] RegQueryValueExW (in: hKey=0x330, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.931] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x334) returned 0x0 [0068.931] RegQueryValueExW (in: hKey=0x334, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.931] RegQueryValueExW (in: hKey=0x334, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.931] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x338) returned 0x0 [0068.931] RegQueryValueExW (in: hKey=0x338, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.931] RegQueryValueExW (in: hKey=0x338, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.931] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x33c) returned 0x0 [0068.931] RegQueryValueExW (in: hKey=0x33c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.931] RegQueryValueExW (in: hKey=0x33c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.932] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x340) returned 0x0 [0068.932] RegQueryValueExW (in: hKey=0x340, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.932] RegQueryValueExW (in: hKey=0x340, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.932] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x344) returned 0x0 [0068.932] RegQueryValueExW (in: hKey=0x344, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.932] RegQueryValueExW (in: hKey=0x344, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.932] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x348) returned 0x0 [0068.932] RegQueryValueExW (in: hKey=0x348, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.932] RegQueryValueExW (in: hKey=0x348, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x0, lpData=0x0, lpcbData=0x549f858*=0x0) returned 0x2 [0068.932] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{f325f05b-f963-4640-a43b-c8a494cdda0f}", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x34c) returned 0x0 [0068.932] RegQueryValueExW (in: hKey=0x34c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x1, lpData=0x0, lpcbData=0x549f858*=0x7c) returned 0x0 [0068.933] RegQueryValueExW (in: hKey=0x34c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x26cb760, lpcbData=0x549f858*=0x7c | out: lpType=0x549f85c*=0x1, lpData="Microsoft Visual C++ 2017 Redistributable (x86) - 14.10.25017", lpcbData=0x549f858*=0x7c) returned 0x0 [0068.933] RegQueryValueExW (in: hKey=0x34c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x1, lpData=0x0, lpcbData=0x549f858*=0x1c) returned 0x0 [0068.933] RegQueryValueExW (in: hKey=0x34c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x26cb870, lpcbData=0x549f858*=0x1c | out: lpType=0x549f85c*=0x1, lpData="14.10.25017.0", lpcbData=0x549f858*=0x1c) returned 0x0 [0068.933] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}", ulOptions=0x0, samDesired=0x20019, phkResult=0x549f83c | out: phkResult=0x549f83c*=0x350) returned 0x0 [0068.933] RegQueryValueExW (in: hKey=0x350, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x1, lpData=0x0, lpcbData=0x549f858*=0x7c) returned 0x0 [0068.933] RegQueryValueExW (in: hKey=0x350, lpValueName="DisplayName", lpReserved=0x0, lpType=0x549f85c, lpData=0x26cba88, lpcbData=0x549f858*=0x7c | out: lpType=0x549f85c*=0x1, lpData="Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005", lpcbData=0x549f858*=0x7c) returned 0x0 [0068.933] RegQueryValueExW (in: hKey=0x350, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x0, lpcbData=0x549f858*=0x0 | out: lpType=0x549f85c*=0x1, lpData=0x0, lpcbData=0x549f858*=0x16) returned 0x0 [0068.933] RegQueryValueExW (in: hKey=0x350, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x549f85c, lpData=0x26cbb98, lpcbData=0x549f858*=0x16 | out: lpType=0x549f85c*=0x1, lpData="12.0.21005", lpcbData=0x549f858*=0x16) returned 0x0 [0069.561] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0071.182] CreatePipe (in: hReadPipe=0x549f688, hWritePipe=0x549f684, lpPipeAttributes=0x549f608, nSize=0x0 | out: hReadPipe=0x549f688*=0x3bc, hWritePipe=0x549f684*=0x3c0) returned 1 [0071.184] GetCurrentProcess () returned 0xffffffff [0071.184] GetCurrentProcess () returned 0xffffffff [0071.184] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x3bc, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x549f68c, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x549f68c*=0x3c4) returned 1 [0071.185] CloseHandle (hObject=0x3bc) returned 1 [0071.185] CreatePipe (in: hReadPipe=0x549f688, hWritePipe=0x549f684, lpPipeAttributes=0x549f608, nSize=0x0 | out: hReadPipe=0x549f688*=0x3bc, hWritePipe=0x549f684*=0x3c8) returned 1 [0071.185] GetCurrentProcess () returned 0xffffffff [0071.185] GetCurrentProcess () returned 0xffffffff [0071.185] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x3bc, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x549f68c, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x549f68c*=0x3cc) returned 1 [0071.185] CloseHandle (hObject=0x3bc) returned 1 [0071.186] CoTaskMemAlloc (cb=0x20e) returned 0x7b4bf8 [0071.186] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x7b4bf8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0071.186] CoTaskMemFree (pv=0x7b4bf8) [0071.187] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"cmd.exe\" /C chcp 65001 && netsh wlan show profile | findstr All", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x549f590*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x3c0, hStdError=0x3c8), lpProcessInformation=0x26d44f0 | out: lpCommandLine="\"cmd.exe\" /C chcp 65001 && netsh wlan show profile | findstr All", lpProcessInformation=0x26d44f0*(hProcess=0x3f8, hThread=0x3f4, dwProcessId=0x82c, dwThreadId=0x83c)) returned 1 [0071.848] CloseHandle (hObject=0x3c0) returned 1 [0071.848] CloseHandle (hObject=0x3c8) returned 1 [0078.881] GetFileType (hFile=0x3c4) returned 0x3 [0078.883] GetFileType (hFile=0x3cc) returned 0x3 [0078.884] CloseHandle (hObject=0x3f4) returned 1 [0078.884] ReadFile (hFile=0x3c4, lpBuffer=0x26d5dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x549f73c, lpOverlapped=0x0) Thread: id = 11 os_tid = 0x518 Thread: id = 12 os_tid = 0x48c [0067.788] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0068.551] CoTaskMemAlloc (cb=0x20c) returned 0x76e728 [0068.551] SHGetFolderPathW (in: hwnd=0x0, csidl=0, hToken=0x0, dwFlags=0x0, pszPath=0x76e728 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x0 [0068.551] CoTaskMemFree (pv=0x76e728) [0068.551] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x4c2d91c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0068.551] CoTaskMemAlloc (cb=0x20c) returned 0x76e728 [0068.551] SHGetFolderPathW (in: hwnd=0x0, csidl=39, hToken=0x0, dwFlags=0x0, pszPath=0x76e728 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned 0x0 [0068.553] CoTaskMemFree (pv=0x76e728) [0068.553] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", nBufferLength=0x105, lpBuffer=0x4c2d91c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", lpFilePart=0x0) returned 0x26 [0068.553] CoTaskMemAlloc (cb=0x20c) returned 0x76e728 [0068.553] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x76e728 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned 0x0 [0068.553] CoTaskMemFree (pv=0x76e728) [0068.553] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", nBufferLength=0x105, lpBuffer=0x4c2d91c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", lpFilePart=0x0) returned 0x27 [0068.553] CoTaskMemAlloc (cb=0x20c) returned 0x76e728 [0068.553] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x76e728 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0068.553] CoTaskMemFree (pv=0x76e728) [0068.553] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", nBufferLength=0x105, lpBuffer=0x4c2d91c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d [0068.554] CoTaskMemAlloc (cb=0x20c) returned 0x76e728 [0068.554] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x76e728 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x0 [0068.554] CoTaskMemFree (pv=0x76e728) [0068.554] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x4c2d91c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpFilePart=0x0) returned 0x2d [0068.554] CoTaskMemAlloc (cb=0x20c) returned 0x76e728 [0068.554] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x76e728 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x0 [0068.554] CoTaskMemFree (pv=0x76e728) [0068.554] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x4c2d91c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpFilePart=0x0) returned 0x2d [0068.872] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x4c2e850, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0068.873] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\22e94f5071aaed0706b87ec862736685-mat-debug.tmp", nBufferLength=0x105, lpBuffer=0x4c2e864, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\22e94f5071aaed0706b87ec862736685-mat-debug.tmp", lpFilePart=0x0) returned 0x80 [0068.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x4c2ecc4) returned 1 [0068.873] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\22e94f5071aaed0706b87ec862736685-mat-debug.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\22e94f5071aaed0706b87ec862736685-mat-debug.tmp"), fInfoLevelId=0x0, lpFileInformation=0x4c2ed40 | out: lpFileInformation=0x4c2ed40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0068.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x4c2ecc0) returned 1 [0068.923] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x4c2e84c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0068.924] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", nBufferLength=0x105, lpBuffer=0x4c2e860, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", lpFilePart=0x0) returned 0x72 [0068.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x4c2ecfc) returned 1 [0068.924] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89"), fInfoLevelId=0x0, lpFileInformation=0x26c9914 | out: lpFileInformation=0x26c9914*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0068.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x4c2ecf8) returned 1 [0068.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x4c2ec68) returned 1 [0068.925] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89"), fInfoLevelId=0x0, lpFileInformation=0x4c2ece4 | out: lpFileInformation=0x4c2ece4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0068.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x4c2ec64) returned 1 [0068.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x4c2ec68) returned 1 [0068.925] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89"), fInfoLevelId=0x0, lpFileInformation=0x4c2ece4 | out: lpFileInformation=0x4c2ece4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0068.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x4c2ec64) returned 1 [0068.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x4c2ec68) returned 1 [0068.925] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431"), fInfoLevelId=0x0, lpFileInformation=0x4c2ece4 | out: lpFileInformation=0x4c2ece4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0068.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x4c2ec64) returned 1 [0068.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x4c2ec68) returned 1 [0068.925] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp"), fInfoLevelId=0x0, lpFileInformation=0x4c2ece4 | out: lpFileInformation=0x4c2ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf1804b30, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf1804b30, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x10000)) returned 1 [0068.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x4c2ec64) returned 1 [0068.926] CreateDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431"), lpSecurityAttributes=0x0) returned 1 [0068.927] CreateDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89"), lpSecurityAttributes=0x0) returned 1 [0069.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x4c2ed14) returned 1 [0069.001] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89"), fInfoLevelId=0x0, lpFileInformation=0x26c9914 | out: lpFileInformation=0x26c9914*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf3e40c90, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf3e40c90, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x4c2ed10) returned 1 [0069.001] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", nBufferLength=0x105, lpBuffer=0x4c2e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", lpFilePart=0x0) returned 0x72 [0069.044] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", dwFileAttributes=0x2012) returned 1 [0069.052] GetCurrentProcess () returned 0xffffffff [0069.053] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x4c2ecfc | out: TokenHandle=0x4c2ecfc*=0x368) returned 1 [0069.057] GetTokenInformation (in: TokenHandle=0x368, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x4c2ecfc | out: TokenInformation=0x0, ReturnLength=0x4c2ecfc) returned 0 [0069.058] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x76e6f0 [0069.058] GetTokenInformation (in: TokenHandle=0x368, TokenInformationClass=0x8, TokenInformation=0x76e6f0, TokenInformationLength=0x4, ReturnLength=0x4c2ecfc | out: TokenInformation=0x76e6f0, ReturnLength=0x4c2ecfc) returned 1 [0069.059] LocalFree (hMem=0x76e6f0) returned 0x0 [0069.060] DuplicateTokenEx (in: hExistingToken=0x368, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x4c2ed04 | out: phNewToken=0x4c2ed04*=0x36c) returned 1 [0069.061] CheckTokenMembership (in: TokenHandle=0x36c, SidToCheck=0x26d3fd8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x4c2ed14 | out: IsMember=0x4c2ed14) returned 1 [0069.061] CloseHandle (hObject=0x36c) returned 1 [0069.115] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x390 [0069.562] CoGetObjectContext (in: riid=0x26d46a0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4c2e608 | out: ppv=0x4c2e608*=0x74bcbc) returned 0x0 [0079.948] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x4c2d898, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0079.971] LoadLibraryA (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll") returned 0x74470000 [0080.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ResetSecurity", cchWideChar=13, lpMultiByteStr=0x4c2ddcc, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ResetSecurity\x1aut/\x1aæ¿\x94 t\x90àÂ\x04\x18¢v", lpUsedDefaultChar=0x0) returned 13 [0080.363] GetProcAddress (hModule=0x74470000, lpProcName="ResetSecurity") returned 0x744724de [0080.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SetSecurity", cchWideChar=11, lpMultiByteStr=0x4c2ddcc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SetSecurity", lpUsedDefaultChar=0x0) returned 11 [0080.611] GetProcAddress (hModule=0x74470000, lpProcName="SetSecurity") returned 0x74472520 [0080.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServices", cchWideChar=18, lpMultiByteStr=0x4c2ddc8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServicesut/\x1aæ¿\x94 t\x90àÂ\x04", lpUsedDefaultChar=0x0) returned 18 [0080.621] GetProcAddress (hModule=0x74470000, lpProcName="BlessIWbemServices") returned 0x74471c69 [0080.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServicesObject", cchWideChar=24, lpMultiByteStr=0x4c2ddc0, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServicesObjectD\x1aut/\x1aæ¿\x94 t\x90àÂ\x04", lpUsedDefaultChar=0x0) returned 24 [0080.712] GetProcAddress (hModule=0x74470000, lpProcName="BlessIWbemServicesObject") returned 0x74471cbb [0080.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyHandle", cchWideChar=17, lpMultiByteStr=0x4c2ddc8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyHandle\x1aut/\x1aæ¿\x94 t\x90àÂ\x04", lpUsedDefaultChar=0x0) returned 17 [0080.781] GetProcAddress (hModule=0x74470000, lpProcName="GetPropertyHandle") returned 0x744721b4 [0080.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WritePropertyValue", cchWideChar=18, lpMultiByteStr=0x4c2ddc8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WritePropertyValueut/\x1aæ¿\x94 t\x90àÂ\x04", lpUsedDefaultChar=0x0) returned 18 [0080.793] GetProcAddress (hModule=0x74470000, lpProcName="WritePropertyValue") returned 0x74472617 [0080.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x4c2ddd4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clone\x1aut/\x1aæ¿\x94 t\x90àÂ\x04", lpUsedDefaultChar=0x0) returned 5 [0080.805] GetProcAddress (hModule=0x74470000, lpProcName="Clone") returned 0x74471d0d [0080.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VerifyClientKey", cchWideChar=15, lpMultiByteStr=0x4c2ddc8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VerifyClientKey", lpUsedDefaultChar=0x0) returned 15 [0080.861] GetProcAddress (hModule=0x74470000, lpProcName="VerifyClientKey") returned 0x744725b4 [0080.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetQualifierSet", cchWideChar=15, lpMultiByteStr=0x4c2ddc8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetQualifierSet", lpUsedDefaultChar=0x0) returned 15 [0080.866] GetProcAddress (hModule=0x74470000, lpProcName="GetQualifierSet") returned 0x74472215 [0080.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Get", cchWideChar=3, lpMultiByteStr=0x4c2ddd4, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Get", lpUsedDefaultChar=0x0) returned 3 [0080.868] GetProcAddress (hModule=0x74470000, lpProcName="Get") returned 0x744720d4 [0080.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Put", cchWideChar=3, lpMultiByteStr=0x4c2ddd4, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Put", lpUsedDefaultChar=0x0) returned 3 [0080.887] GetProcAddress (hModule=0x74470000, lpProcName="Put") returned 0x744722be [0081.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Delete", cchWideChar=6, lpMultiByteStr=0x4c2ddd4, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Deleteut/\x1aæ¿\x94 t\x90àÂ\x04", lpUsedDefaultChar=0x0) returned 6 [0081.261] GetProcAddress (hModule=0x74470000, lpProcName="Delete") returned 0x74471f31 [0081.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetNames", cchWideChar=8, lpMultiByteStr=0x4c2ddd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetNamesD\x1aut/\x1aæ¿\x94 t\x90àÂ\x04", lpUsedDefaultChar=0x0) returned 8 [0081.272] GetProcAddress (hModule=0x74470000, lpProcName="GetNames") returned 0x74472182 [0081.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeginEnumeration", cchWideChar=16, lpMultiByteStr=0x4c2ddc8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeginEnumerationD\x1aut/\x1aæ¿\x94 t\x90àÂ\x04", lpUsedDefaultChar=0x0) returned 16 [0081.626] GetProcAddress (hModule=0x74470000, lpProcName="BeginEnumeration") returned 0x74471c43 [0081.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Next", cchWideChar=4, lpMultiByteStr=0x4c2ddd4, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NextD\x1aut/\x1aæ¿\x94 t\x90àÂ\x04", lpUsedDefaultChar=0x0) returned 4 [0081.634] GetProcAddress (hModule=0x74470000, lpProcName="Next") returned 0x74472283 [0081.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EndEnumeration", cchWideChar=14, lpMultiByteStr=0x4c2ddcc, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EndEnumerationut/\x1aæ¿\x94 t\x90àÂ\x04", lpUsedDefaultChar=0x0) returned 14 [0081.763] GetProcAddress (hModule=0x74470000, lpProcName="EndEnumeration") returned 0x74471fc2 [0081.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyQualifierSet", cchWideChar=23, lpMultiByteStr=0x4c2ddc0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyQualifierSet", lpUsedDefaultChar=0x0) returned 23 [0081.770] GetProcAddress (hModule=0x74470000, lpProcName="GetPropertyQualifierSet") returned 0x744721ff [0082.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x4c2ddd4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clone\x1aut/\x1aæ¿\x94 t\x90àÂ\x04", lpUsedDefaultChar=0x0) returned 5 [0082.047] GetProcAddress (hModule=0x74470000, lpProcName="Clone") returned 0x74471d0d [0082.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetObjectText", cchWideChar=13, lpMultiByteStr=0x4c2ddcc, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetObjectText\x1aut/\x1aæ¿\x94 t\x90àÂ\x04", lpUsedDefaultChar=0x0) returned 13 [0082.047] GetProcAddress (hModule=0x74470000, lpProcName="GetObjectText") returned 0x7447219e [0082.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SpawnDerivedClass", cchWideChar=17, lpMultiByteStr=0x4c2ddc8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpawnDerivedClass\x1aut/\x1aæ¿\x94 t\x90àÂ\x04", lpUsedDefaultChar=0x0) returned 17 [0082.061] GetProcAddress (hModule=0x74470000, lpProcName="SpawnDerivedClass") returned 0x74472566 [0082.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SpawnInstance", cchWideChar=13, lpMultiByteStr=0x4c2ddcc, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpawnInstance\x1aut/\x1aæ¿\x94 t\x90àÂ\x04", lpUsedDefaultChar=0x0) returned 13 [0082.071] GetProcAddress (hModule=0x74470000, lpProcName="SpawnInstance") returned 0x7447257c [0082.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CompareTo", cchWideChar=9, lpMultiByteStr=0x4c2ddd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CompareTo\x1aut/\x1aæ¿\x94 t\x90àÂ\x04", lpUsedDefaultChar=0x0) returned 9 [0082.211] GetProcAddress (hModule=0x74470000, lpProcName="CompareTo") returned 0x74471d8d [0082.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyOrigin", cchWideChar=17, lpMultiByteStr=0x4c2ddc8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyOrigin\x1aut/\x1aæ¿\x94 t\x90àÂ\x04", lpUsedDefaultChar=0x0) returned 17 [0082.220] GetProcAddress (hModule=0x74470000, lpProcName="GetPropertyOrigin") returned 0x744721e9 [0082.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="InheritsFrom", cchWideChar=12, lpMultiByteStr=0x4c2ddcc, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InheritsFromD\x1aut/\x1aæ¿\x94 t\x90àÂ\x04", lpUsedDefaultChar=0x0) returned 12 [0082.236] GetProcAddress (hModule=0x74470000, lpProcName="InheritsFrom") returned 0x74472228 [0082.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethod", cchWideChar=9, lpMultiByteStr=0x4c2ddd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethod\x1aut/\x1aæ¿\x94 t\x90àÂ\x04", lpUsedDefaultChar=0x0) returned 9 [0082.237] GetProcAddress (hModule=0x74470000, lpProcName="GetMethod") returned 0x7447213a [0082.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutMethod", cchWideChar=9, lpMultiByteStr=0x4c2ddd0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutMethod\x1aut/\x1aæ¿\x94 t\x90àÂ\x04", lpUsedDefaultChar=0x0) returned 9 [0082.352] GetProcAddress (hModule=0x74470000, lpProcName="PutMethod") returned 0x744723da [0082.365] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DeleteMethod", cchWideChar=12, lpMultiByteStr=0x4c2ddcc, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DeleteMethodD\x1aut/\x1aæ¿\x94 t\x90àÂ\x04", lpUsedDefaultChar=0x0) returned 12 [0082.365] GetProcAddress (hModule=0x74470000, lpProcName="DeleteMethod") returned 0x74471f44 [0082.366] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeginMethodEnumeration", cchWideChar=22, lpMultiByteStr=0x4c2ddc4, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeginMethodEnumerationut/\x1aæ¿\x94 t\x90àÂ\x04", lpUsedDefaultChar=0x0) returned 22 [0082.367] GetProcAddress (hModule=0x74470000, lpProcName="BeginMethodEnumeration") returned 0x74471c56 [0082.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NextMethod", cchWideChar=10, lpMultiByteStr=0x4c2ddd0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NextMethodut/\x1aæ¿\x94 t\x90àÂ\x04", lpUsedDefaultChar=0x0) returned 10 [0082.368] GetProcAddress (hModule=0x74470000, lpProcName="NextMethod") returned 0x744722a2 [0082.381] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EndMethodEnumeration", cchWideChar=20, lpMultiByteStr=0x4c2ddc4, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EndMethodEnumerationD\x1aut/\x1aæ¿\x94 t\x90àÂ\x04", lpUsedDefaultChar=0x0) returned 20 [0082.381] GetProcAddress (hModule=0x74470000, lpProcName="EndMethodEnumeration") returned 0x74471fd2 [0082.382] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethodQualifierSet", cchWideChar=21, lpMultiByteStr=0x4c2ddc4, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodQualifierSet\x1aut/\x1aæ¿\x94 t\x90àÂ\x04", lpUsedDefaultChar=0x0) returned 21 [0082.383] GetProcAddress (hModule=0x74470000, lpProcName="GetMethodQualifierSet") returned 0x7447216c [0082.405] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethodOrigin", cchWideChar=15, lpMultiByteStr=0x4c2ddc8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodOrigin", lpUsedDefaultChar=0x0) returned 15 [0082.406] GetProcAddress (hModule=0x74470000, lpProcName="GetMethodOrigin") returned 0x74472156 [0082.407] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Get", cchWideChar=16, lpMultiByteStr=0x4c2ddc8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_GetD\x1aut/\x1aæ¿\x94 t\x90àÂ\x04", lpUsedDefaultChar=0x0) returned 16 [0082.407] GetProcAddress (hModule=0x74470000, lpProcName="QualifierSet_Get") returned 0x7447242c [0082.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Put", cchWideChar=16, lpMultiByteStr=0x4c2ddc8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_PutD\x1aut/\x1aæ¿\x94 t\x90àÂ\x04", lpUsedDefaultChar=0x0) returned 16 [0082.424] GetProcAddress (hModule=0x74470000, lpProcName="QualifierSet_Put") returned 0x7447247a [0082.439] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Delete", cchWideChar=19, lpMultiByteStr=0x4c2ddc4, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Delete", lpUsedDefaultChar=0x0) returned 19 [0082.439] GetProcAddress (hModule=0x74470000, lpProcName="QualifierSet_Delete") returned 0x74472409 [0082.441] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_GetNames", cchWideChar=21, lpMultiByteStr=0x4c2ddc4, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_GetNames\x1aut/\x1aæ¿\x94 t\x90àÂ\x04", lpUsedDefaultChar=0x0) returned 21 [0082.441] GetProcAddress (hModule=0x74470000, lpProcName="QualifierSet_GetNames") returned 0x74472448 [0083.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_BeginEnumeration", cchWideChar=29, lpMultiByteStr=0x4c2ddbc, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_BeginEnumeration\x1aut/\x1aæ¿\x94 t\x90àÂ\x04", lpUsedDefaultChar=0x0) returned 29 [0083.013] GetProcAddress (hModule=0x74470000, lpProcName="QualifierSet_BeginEnumeration") returned 0x744723f6 [0083.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Next", cchWideChar=17, lpMultiByteStr=0x4c2ddc8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Next\x1aut/\x1aæ¿\x94 t\x90àÂ\x04", lpUsedDefaultChar=0x0) returned 17 [0083.015] GetProcAddress (hModule=0x74470000, lpProcName="QualifierSet_Next") returned 0x7447245e [0083.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_EndEnumeration", cchWideChar=27, lpMultiByteStr=0x4c2ddbc, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_EndEnumeration", lpUsedDefaultChar=0x0) returned 27 [0083.029] GetProcAddress (hModule=0x74470000, lpProcName="QualifierSet_EndEnumeration") returned 0x7447241c [0083.030] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetCurrentApartmentType", cchWideChar=23, lpMultiByteStr=0x4c2ddc0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetCurrentApartmentType", lpUsedDefaultChar=0x0) returned 23 [0083.030] GetProcAddress (hModule=0x74470000, lpProcName="GetCurrentApartmentType") returned 0x74472215 [0083.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetDemultiplexedStub", cchWideChar=20, lpMultiByteStr=0x4c2ddc4, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetDemultiplexedStubD\x1aut/\x1aæ¿\x94 t\x90àÂ\x04", lpUsedDefaultChar=0x0) returned 20 [0083.039] GetProcAddress (hModule=0x74470000, lpProcName="GetDemultiplexedStub") returned 0x744720f3 [0083.302] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateInstanceEnumWmi", cchWideChar=21, lpMultiByteStr=0x4c2ddc4, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateInstanceEnumWmi\x1aut/\x1aæ¿\x94 t\x90àÂ\x04", lpUsedDefaultChar=0x0) returned 21 [0083.302] GetProcAddress (hModule=0x74470000, lpProcName="CreateInstanceEnumWmi") returned 0x74471ebb [0083.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateClassEnumWmi", cchWideChar=18, lpMultiByteStr=0x4c2ddc8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateClassEnumWmiut/\x1aæ¿\x94 t\x90àÂ\x04", lpUsedDefaultChar=0x0) returned 18 [0083.335] GetProcAddress (hModule=0x74470000, lpProcName="CreateClassEnumWmi") returned 0x74471e45 [0083.449] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ExecQueryWmi", cchWideChar=12, lpMultiByteStr=0x4c2ddcc, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExecQueryWmiD\x1aut/\x1aæ¿\x94 t\x90àÂ\x04", lpUsedDefaultChar=0x0) returned 12 [0083.450] GetProcAddress (hModule=0x74470000, lpProcName="ExecQueryWmi") returned 0x7447205b [0083.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ExecNotificationQueryWmi", cchWideChar=24, lpMultiByteStr=0x4c2ddc0, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExecNotificationQueryWmiD\x1aut/\x1aæ¿\x94 t\x90àÂ\x04", lpUsedDefaultChar=0x0) returned 24 [0083.489] GetProcAddress (hModule=0x74470000, lpProcName="ExecNotificationQueryWmi") returned 0x74471fe2 [0083.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutInstanceWmi", cchWideChar=14, lpMultiByteStr=0x4c2ddcc, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutInstanceWmiut/\x1aæ¿\x94 t\x90àÂ\x04", lpUsedDefaultChar=0x0) returned 14 [0083.676] GetProcAddress (hModule=0x74470000, lpProcName="PutInstanceWmi") returned 0x7447235a [0083.708] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutClassWmi", cchWideChar=11, lpMultiByteStr=0x4c2ddcc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutClassWmi", lpUsedDefaultChar=0x0) returned 11 [0083.709] GetProcAddress (hModule=0x74470000, lpProcName="PutClassWmi") returned 0x744722da [0083.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloneEnumWbemClassObject", cchWideChar=24, lpMultiByteStr=0x4c2ddc0, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloneEnumWbemClassObjectD\x1aut/\x1aæ¿\x94 t\x90àÂ\x04", lpUsedDefaultChar=0x0) returned 24 [0083.747] GetProcAddress (hModule=0x74470000, lpProcName="CloneEnumWbemClassObject") returned 0x74471d20 [0083.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ConnectServerWmi", cchWideChar=16, lpMultiByteStr=0x4c2ddc8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ConnectServerWmiD\x1aut/\x1aæ¿\x94 t\x90àÂ\x04", lpUsedDefaultChar=0x0) returned 16 [0083.779] GetProcAddress (hModule=0x74470000, lpProcName="ConnectServerWmi") returned 0x74471da3 [0084.065] IComThreadingInfo:GetCurrentApartmentType (in: This=0x74bcbc, pAptType=0x4c2e600 | out: pAptType=0x4c2e600*=1) returned 0x0 [0084.389] IUnknown:QueryInterface (in: This=0x74bcbc, riid=0x26d4688*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x4c2e604 | out: ppvObject=0x4c2e604*=0x0) returned 0x80004002 [0084.390] IUnknown:Release (This=0x74bcbc) returned 0x0 [0084.412] IIDFromString (in: lpsz="{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}", lpiid=0x4c2e25c | out: lpiid=0x4c2e25c) returned 0x0 [0084.413] CoGetClassObject (in: rclsid=0x7d81b4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x74aad1fc*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4c2df70 | out: ppv=0x4c2df70*=0xa10810) returned 0x0 [0088.909] WbemDefPath:IUnknown:QueryInterface (in: This=0xa10810, riid=0x74ae0ae0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4c2e188 | out: ppvObject=0x4c2e188*=0x0) returned 0x80004002 [0088.909] WbemDefPath:IClassFactory:CreateInstance (in: This=0xa10810, pUnkOuter=0x0, riid=0x74a1e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4c2e19c | out: ppvObject=0x4c2e19c*=0xa10820) returned 0x0 [0088.910] WbemDefPath:IUnknown:Release (This=0xa10810) returned 0x0 [0088.910] WbemDefPath:IUnknown:QueryInterface (in: This=0xa10820, riid=0x74a1e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4c2ddbc | out: ppvObject=0x4c2ddbc*=0xa10820) returned 0x0 [0088.976] WbemDefPath:IUnknown:QueryInterface (in: This=0xa10820, riid=0x74b4fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4c2dd78 | out: ppvObject=0x4c2dd78*=0x0) returned 0x80004002 [0088.976] WbemDefPath:IUnknown:AddRef (This=0xa10820) returned 0x3 [0088.976] WbemDefPath:IUnknown:QueryInterface (in: This=0xa10820, riid=0x74b4f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4c2d6d4 | out: ppvObject=0x4c2d6d4*=0x0) returned 0x80004002 [0088.976] WbemDefPath:IUnknown:QueryInterface (in: This=0xa10820, riid=0x74b4f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4c2d684 | out: ppvObject=0x4c2d684*=0x0) returned 0x80004002 [0088.976] WbemDefPath:IUnknown:QueryInterface (in: This=0xa10820, riid=0x74b3c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4c2d690 | out: ppvObject=0x4c2d690*=0x7e32c8) returned 0x0 [0088.976] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x7e32c8, riid=0x74a1e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4c2d698 | out: pCid=0x4c2d698*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0088.976] WbemDefPath:IUnknown:Release (This=0x7e32c8) returned 0x3 [0088.976] CoGetContextToken (in: pToken=0x4c2d6f0 | out: pToken=0x4c2d6f0) returned 0x0 [0088.977] CoGetContextToken (in: pToken=0x4c2daf8 | out: pToken=0x4c2daf8) returned 0x0 [0088.977] WbemDefPath:IUnknown:QueryInterface (in: This=0xa10820, riid=0x74b4fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4c2db88 | out: ppvObject=0x4c2db88*=0x0) returned 0x80004002 [0088.977] WbemDefPath:IUnknown:Release (This=0xa10820) returned 0x2 [0088.977] WbemDefPath:IUnknown:Release (This=0xa10820) returned 0x1 [0088.978] CoGetContextToken (in: pToken=0x4c2e480 | out: pToken=0x4c2e480) returned 0x0 [0088.978] CoGetContextToken (in: pToken=0x4c2e3e0 | out: pToken=0x4c2e3e0) returned 0x0 [0088.978] WbemDefPath:IUnknown:QueryInterface (in: This=0xa10820, riid=0x4c2e4b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x4c2e4ac | out: ppvObject=0x4c2e4ac*=0xa10820) returned 0x0 [0088.978] WbemDefPath:IUnknown:AddRef (This=0xa10820) returned 0x3 [0088.978] WbemDefPath:IUnknown:Release (This=0xa10820) returned 0x2 [0088.980] WbemDefPath:IWbemPath:SetText (This=0xa10820, uMode=0x4, pszPath="//./root/cimv2") returned 0x0 [0088.981] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa10820, puCount=0x4c2ed2c | out: puCount=0x4c2ed2c*=0x2) returned 0x0 [0088.982] WbemDefPath:IWbemPath:GetText (in: This=0xa10820, lFlags=4, puBuffLength=0x4c2ed28*=0x0, pszText=0x0 | out: puBuffLength=0x4c2ed28*=0xf, pszText=0x0) returned 0x0 [0088.984] WbemDefPath:IWbemPath:GetText (in: This=0xa10820, lFlags=4, puBuffLength=0x4c2ed28*=0xf, pszText="00000000000000" | out: puBuffLength=0x4c2ed28*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0088.986] CoGetObjectContext (in: riid=0x26d46a0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4c2ecb8 | out: ppv=0x4c2ecb8*=0x74bcbc) returned 0x0 [0088.987] IComThreadingInfo:GetCurrentApartmentType (in: This=0x74bcbc, pAptType=0x4c2ecb0 | out: pAptType=0x4c2ecb0*=1) returned 0x0 [0088.987] IUnknown:QueryInterface (in: This=0x74bcbc, riid=0x26d4688*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x4c2ecb4 | out: ppvObject=0x4c2ecb4*=0x0) returned 0x80004002 [0088.987] IUnknown:Release (This=0x74bcbc) returned 0x0 [0088.987] IIDFromString (in: lpsz="{4590F811-1D3A-11D0-891F-00AA004B2E24}", lpiid=0x4c2ebc4 | out: lpiid=0x4c2ebc4) returned 0x0 [0088.989] CoGetClassObject (in: rclsid=0x7d8544*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x74aad1fc*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4c2e8d8 | out: ppv=0x4c2e8d8*=0xa108e0) returned 0x0 [0089.496] WbemLocator:IUnknown:QueryInterface (in: This=0xa108e0, riid=0x74ae0ae0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4c2eaf0 | out: ppvObject=0x4c2eaf0*=0x0) returned 0x80004002 [0089.496] WbemLocator:IClassFactory:CreateInstance (in: This=0xa108e0, pUnkOuter=0x0, riid=0x74a1e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4c2eb04 | out: ppvObject=0x4c2eb04*=0xa10a00) returned 0x0 [0089.496] WbemLocator:IUnknown:Release (This=0xa108e0) returned 0x0 [0089.496] WbemLocator:IUnknown:QueryInterface (in: This=0xa10a00, riid=0x74a1e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4c2e724 | out: ppvObject=0x4c2e724*=0xa10a00) returned 0x0 [0089.496] WbemLocator:IUnknown:QueryInterface (in: This=0xa10a00, riid=0x74b4fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4c2e6e0 | out: ppvObject=0x4c2e6e0*=0x0) returned 0x80004002 [0089.496] WbemLocator:IUnknown:AddRef (This=0xa10a00) returned 0x3 [0089.496] WbemLocator:IUnknown:QueryInterface (in: This=0xa10a00, riid=0x74b4f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4c2e03c | out: ppvObject=0x4c2e03c*=0x0) returned 0x80004002 [0089.496] WbemLocator:IUnknown:QueryInterface (in: This=0xa10a00, riid=0x74b4f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4c2dfec | out: ppvObject=0x4c2dfec*=0x0) returned 0x80004002 [0089.496] WbemLocator:IUnknown:QueryInterface (in: This=0xa10a00, riid=0x74b3c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4c2dff8 | out: ppvObject=0x4c2dff8*=0x0) returned 0x80004002 [0089.496] CoGetContextToken (in: pToken=0x4c2e058 | out: pToken=0x4c2e058) returned 0x0 [0089.497] CoGetObjectContext (in: riid=0x74a1e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x7e104c | out: ppv=0x7e104c*=0x74bcb0) returned 0x0 [0089.497] CoGetContextToken (in: pToken=0x4c2e460 | out: pToken=0x4c2e460) returned 0x0 [0089.497] WbemLocator:IUnknown:QueryInterface (in: This=0xa10a00, riid=0x74b4fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4c2e4f0 | out: ppvObject=0x4c2e4f0*=0x0) returned 0x80004002 [0089.497] WbemLocator:IUnknown:Release (This=0xa10a00) returned 0x2 [0089.497] WbemLocator:IUnknown:Release (This=0xa10a00) returned 0x1 [0089.497] CoGetContextToken (in: pToken=0x4c2ead0 | out: pToken=0x4c2ead0) returned 0x0 [0089.497] CoGetContextToken (in: pToken=0x4c2ea30 | out: pToken=0x4c2ea30) returned 0x0 [0089.497] WbemLocator:IUnknown:QueryInterface (in: This=0xa10a00, riid=0x4c2eb00*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x4c2eafc | out: ppvObject=0x4c2eafc*=0xa10a00) returned 0x0 [0089.498] WbemLocator:IUnknown:AddRef (This=0xa10a00) returned 0x3 [0089.498] WbemLocator:IUnknown:Release (This=0xa10a00) returned 0x2 [0089.500] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xa10820, puCount=0x4c2ec94 | out: puCount=0x4c2ec94*=0x2) returned 0x0 [0089.500] WbemDefPath:IWbemPath:GetText (in: This=0xa10820, lFlags=8, puBuffLength=0x4c2ec90*=0x0, pszText=0x0 | out: puBuffLength=0x4c2ec90*=0xf, pszText=0x0) returned 0x0 [0089.500] WbemDefPath:IWbemPath:GetText (in: This=0xa10820, lFlags=8, puBuffLength=0x4c2ec90*=0xf, pszText="00000000000000" | out: puBuffLength=0x4c2ec90*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0089.500] CoCreateInstance (in: rclsid=0x74471284*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x744712e4*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x4c2eb6c | out: ppv=0x4c2eb6c*=0xa10a10) returned 0x0 [0089.500] WbemLocator:IWbemLocator:ConnectServer (This=0xa10a10, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x4c2ec00) Thread: id = 13 os_tid = 0x534 [0067.897] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0067.903] SleepEx (dwMilliseconds=0x2bc, bAlertable=1) returned 0x0 [0068.597] SleepEx (dwMilliseconds=0x2bc, bAlertable=1) returned 0x0 [0071.542] SleepEx (dwMilliseconds=0x2bc, bAlertable=1) returned 0x0 [0073.052] SleepEx (dwMilliseconds=0x2bc, bAlertable=1) returned 0x0 [0079.123] SleepEx (dwMilliseconds=0x2bc, bAlertable=1) returned 0x0 [0080.196] SleepEx (dwMilliseconds=0x2bc, bAlertable=1) returned 0x0 [0081.260] SleepEx (dwMilliseconds=0x2bc, bAlertable=1) returned 0x0 [0082.295] SleepEx (dwMilliseconds=0x2bc, bAlertable=1) returned 0x0 [0083.744] SleepEx (dwMilliseconds=0x2bc, bAlertable=1) returned 0x0 [0084.511] SleepEx (dwMilliseconds=0x2bc, bAlertable=1) returned 0x0 [0085.750] SleepEx (dwMilliseconds=0x2bc, bAlertable=1) returned 0x0 [0088.808] SleepEx (dwMilliseconds=0x2bc, bAlertable=1) returned 0x0 [0090.194] SleepEx (dwMilliseconds=0x2bc, bAlertable=1) Thread: id = 14 os_tid = 0x80c [0068.971] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0068.972] CoGetContextToken (in: pToken=0x584faf4 | out: pToken=0x584faf4) returned 0x0 [0068.972] CObjectContext::QueryInterface () returned 0x0 [0068.972] CObjectContext::GetCurrentThreadType () returned 0x0 [0068.972] Release () returned 0x0 [0068.972] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0068.972] CoUninitialize () [0069.090] LocalAlloc (uFlags=0x0, uBytes=0x11e) returned 0x79dbb8 [0081.557] LocalFree (hMem=0x7a2a60) returned 0x0 [0081.557] LocalFree (hMem=0x79dbb8) returned 0x0 [0083.245] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x584f0a4, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0083.245] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Wallets\\", nBufferLength=0x105, lpBuffer=0x584f0b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Wallets\\", lpFilePart=0x0) returned 0x7b [0083.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x584f4a0) returned 1 [0083.245] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Wallets\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\wallets"), fInfoLevelId=0x0, lpFileInformation=0x584f51c | out: lpFileInformation=0x584f51c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0083.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x584f49c) returned 1 [0083.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x584f4a0) returned 1 [0083.246] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Wallets" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\wallets"), fInfoLevelId=0x0, lpFileInformation=0x584f51c | out: lpFileInformation=0x584f51c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0083.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x584f49c) returned 1 [0083.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x584f4a0) returned 1 [0083.246] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89"), fInfoLevelId=0x0, lpFileInformation=0x584f51c | out: lpFileInformation=0x584f51c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf6ae2910, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf6ae2910, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0083.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x584f49c) returned 1 [0083.246] CreateDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Wallets" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\wallets"), lpSecurityAttributes=0x0) returned 1 [0083.250] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Zcash", nBufferLength=0x105, lpBuffer=0x584f0a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Zcash", lpFilePart=0x0) returned 0x33 [0083.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x584f4fc) returned 1 [0083.251] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Zcash" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\zcash"), fInfoLevelId=0x0, lpFileInformation=0x584f578 | out: lpFileInformation=0x584f578*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0083.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x584f4f8) returned 1 [0083.251] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Armory", nBufferLength=0x105, lpBuffer=0x584f0a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Armory", lpFilePart=0x0) returned 0x34 [0083.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x584f4fc) returned 1 [0083.251] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Armory" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\armory"), fInfoLevelId=0x0, lpFileInformation=0x584f578 | out: lpFileInformation=0x584f578*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0083.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x584f4f8) returned 1 [0083.251] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\bytecoin", nBufferLength=0x105, lpBuffer=0x584f0a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\bytecoin", lpFilePart=0x0) returned 0x36 [0083.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x584f4fc) returned 1 [0083.251] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\bytecoin" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\bytecoin"), fInfoLevelId=0x0, lpFileInformation=0x584f578 | out: lpFileInformation=0x584f578*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0083.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x584f4f8) returned 1 [0083.251] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\com.liberty.jaxx\\IndexedDB\\file__0.indexeddb.leveldb", nBufferLength=0x105, lpBuffer=0x584f0a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\com.liberty.jaxx\\IndexedDB\\file__0.indexeddb.leveldb", lpFilePart=0x0) returned 0x62 [0083.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x584f4fc) returned 1 [0083.252] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\com.liberty.jaxx\\IndexedDB\\file__0.indexeddb.leveldb" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\com.liberty.jaxx\\indexeddb\\file__0.indexeddb.leveldb"), fInfoLevelId=0x0, lpFileInformation=0x584f578 | out: lpFileInformation=0x584f578*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0083.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x584f4f8) returned 1 [0083.252] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\exodus.wallet", nBufferLength=0x105, lpBuffer=0x584f0a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\exodus.wallet", lpFilePart=0x0) returned 0x42 [0083.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x584f4fc) returned 1 [0083.252] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\exodus.wallet" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\exodus\\exodus.wallet"), fInfoLevelId=0x0, lpFileInformation=0x584f578 | out: lpFileInformation=0x584f578*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0083.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x584f4f8) returned 1 [0083.252] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore", nBufferLength=0x105, lpBuffer=0x584f0a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore", lpFilePart=0x0) returned 0x3f [0083.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x584f4fc) returned 1 [0083.252] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ethereum\\keystore"), fInfoLevelId=0x0, lpFileInformation=0x584f578 | out: lpFileInformation=0x584f578*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0083.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x584f4f8) returned 1 [0083.252] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets", nBufferLength=0x105, lpBuffer=0x584f0a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets", lpFilePart=0x0) returned 0x3e [0083.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x584f4fc) returned 1 [0083.252] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\electrum\\wallets"), fInfoLevelId=0x0, lpFileInformation=0x584f578 | out: lpFileInformation=0x584f578*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0083.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x584f4f8) returned 1 [0083.252] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\atomic\\Local Storage\\leveldb", nBufferLength=0x105, lpBuffer=0x584f0a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\atomic\\Local Storage\\leveldb", lpFilePart=0x0) returned 0x4a [0083.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x584f4fc) returned 1 [0083.253] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\atomic\\Local Storage\\leveldb" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\atomic\\local storage\\leveldb"), fInfoLevelId=0x0, lpFileInformation=0x584f578 | out: lpFileInformation=0x584f578*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0083.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x584f4f8) returned 1 [0083.253] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Guarda\\Local Storage\\leveldb", nBufferLength=0x105, lpBuffer=0x584f0a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Guarda\\Local Storage\\leveldb", lpFilePart=0x0) returned 0x4a [0083.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x584f4fc) returned 1 [0083.253] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Guarda\\Local Storage\\leveldb" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\guarda\\local storage\\leveldb"), fInfoLevelId=0x0, lpFileInformation=0x584f578 | out: lpFileInformation=0x584f578*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0083.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x584f4f8) returned 1 [0083.253] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Coinomi\\Coinomi\\wallets", nBufferLength=0x105, lpBuffer=0x584f0a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Coinomi\\Coinomi\\wallets", lpFilePart=0x0) returned 0x43 [0083.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x584f4fc) returned 1 [0083.253] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Coinomi\\Coinomi\\wallets" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\coinomi\\coinomi\\wallets"), fInfoLevelId=0x0, lpFileInformation=0x584f578 | out: lpFileInformation=0x584f578*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0083.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x584f4f8) returned 1 [0083.261] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software", ulOptions=0x0, samDesired=0x20019, phkResult=0x584f558 | out: phkResult=0x584f558*=0x498) returned 0x0 [0083.261] RegOpenKeyExW (in: hKey=0x498, lpSubKey="Litecoin", ulOptions=0x0, samDesired=0x20019, phkResult=0x584f558 | out: phkResult=0x584f558*=0x0) returned 0x2 [0084.068] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software", ulOptions=0x0, samDesired=0x20019, phkResult=0x584f558 | out: phkResult=0x584f558*=0x380) returned 0x0 [0084.068] RegOpenKeyExW (in: hKey=0x380, lpSubKey="Dash", ulOptions=0x0, samDesired=0x20019, phkResult=0x584f558 | out: phkResult=0x584f558*=0x0) returned 0x2 [0084.069] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software", ulOptions=0x0, samDesired=0x20019, phkResult=0x584f558 | out: phkResult=0x584f558*=0x4e8) returned 0x0 [0084.069] RegOpenKeyExW (in: hKey=0x4e8, lpSubKey="Bitcoin", ulOptions=0x0, samDesired=0x20019, phkResult=0x584f558 | out: phkResult=0x584f558*=0x0) returned 0x2 [0084.070] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x584f0c8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0084.070] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Wallets\\", nBufferLength=0x105, lpBuffer=0x584f0dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Wallets\\", lpFilePart=0x0) returned 0x7b [0084.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x584f528) returned 1 [0084.070] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Wallets\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\wallets"), fInfoLevelId=0x0, lpFileInformation=0x584f5a8 | out: lpFileInformation=0x584f5a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf6d6a070, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf6d6a070, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf6d6a070, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0084.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x584f524) returned 1 [0084.071] RemoveDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Wallets\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\wallets")) returned 1 [0084.075] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Authy Desktop\\Local Storage\\leveldb\\", nBufferLength=0x105, lpBuffer=0x584f0e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Authy Desktop\\Local Storage\\leveldb\\", lpFilePart=0x0) returned 0x52 [0084.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x584f540) returned 1 [0084.076] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Authy Desktop\\Local Storage\\leveldb\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\authy desktop\\local storage\\leveldb"), fInfoLevelId=0x0, lpFileInformation=0x584f5bc | out: lpFileInformation=0x584f5bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0084.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x584f53c) returned 1 [0090.252] GetSystemMetrics (nIndex=76) returned 0 [0090.252] GetSystemMetrics (nIndex=77) returned 0 [0090.252] GetSystemMetrics (nIndex=78) returned 1440 [0090.252] GetSystemMetrics (nIndex=79) returned 900 [0090.252] GetSystemMetrics (nIndex=76) returned 0 [0090.252] GetSystemMetrics (nIndex=77) returned 0 [0090.252] GetSystemMetrics (nIndex=78) returned 1440 [0090.252] GetSystemMetrics (nIndex=79) returned 900 [0090.252] GetSystemMetrics (nIndex=76) returned 0 [0090.252] GetSystemMetrics (nIndex=77) returned 0 [0090.252] GetSystemMetrics (nIndex=78) returned 1440 [0090.252] GetSystemMetrics (nIndex=79) returned 900 [0090.252] GetSystemMetrics (nIndex=76) returned 0 [0090.252] GetSystemMetrics (nIndex=77) returned 0 [0090.252] GetSystemMetrics (nIndex=78) returned 1440 [0090.252] GetSystemMetrics (nIndex=79) returned 900 Thread: id = 15 os_tid = 0x81c [0069.101] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0069.132] ShellExecuteExW (in: pExecInfo=0x26d41bc*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="cmd.exe", lpParameters="/C tasklist /FO TABLE > \"C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\processes.txt\"", lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x26d41bc*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="cmd.exe", lpParameters="/C tasklist /FO TABLE > \"C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\processes.txt\"", lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x520)) returned 1 [0080.358] CoGetContextToken (in: pToken=0x5a7fa00 | out: pToken=0x5a7fa00) returned 0x0 [0080.360] CoUninitialize () Thread: id = 17 os_tid = 0x86c [0078.836] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0078.839] CoGetContextToken (in: pToken=0x5bbf6c4 | out: pToken=0x5bbf6c4) returned 0x0 [0078.839] CObjectContext::QueryInterface () returned 0x0 [0078.840] CObjectContext::GetCurrentThreadType () returned 0x0 [0078.840] Release () returned 0x0 [0078.840] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0078.840] CoUninitialize () [0078.869] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x5bbecc4, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0078.870] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\", nBufferLength=0x105, lpBuffer=0x5bbecd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\", lpFilePart=0x0) returned 0x78 [0078.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf0c0) returned 1 [0078.870] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs"), fInfoLevelId=0x0, lpFileInformation=0x5bbf13c | out: lpFileInformation=0x5bbf13c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0078.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf0bc) returned 1 [0078.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf0c0) returned 1 [0078.871] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs"), fInfoLevelId=0x0, lpFileInformation=0x5bbf13c | out: lpFileInformation=0x5bbf13c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0078.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf0bc) returned 1 [0078.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf0c0) returned 1 [0078.871] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89"), fInfoLevelId=0x0, lpFileInformation=0x5bbf13c | out: lpFileInformation=0x5bbf13c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf3e40c90, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf3e40c90, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0078.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf0bc) returned 1 [0078.871] CreateDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs"), lpSecurityAttributes=0x0) returned 1 [0079.185] CoTaskMemAlloc (cb=0x20c) returned 0x7c8e50 [0079.185] SHGetFolderPathW (in: hwnd=0x0, csidl=0, hToken=0x0, dwFlags=0x0, pszPath=0x7c8e50 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x0 [0079.185] CoTaskMemFree (pv=0x7c8e50) [0079.185] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x5bbd4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0079.185] CoTaskMemAlloc (cb=0x20c) returned 0x7c8e50 [0079.185] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x7c8e50 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned 0x0 [0079.185] CoTaskMemFree (pv=0x7c8e50) [0079.185] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", nBufferLength=0x105, lpBuffer=0x5bbd4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", lpFilePart=0x0) returned 0x27 [0079.185] CoTaskMemAlloc (cb=0x20c) returned 0x7c8e50 [0079.185] SHGetFolderPathW (in: hwnd=0x0, csidl=39, hToken=0x0, dwFlags=0x0, pszPath=0x7c8e50 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned 0x0 [0079.185] CoTaskMemFree (pv=0x7c8e50) [0079.186] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", nBufferLength=0x105, lpBuffer=0x5bbd4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", lpFilePart=0x0) returned 0x26 [0079.186] CoTaskMemAlloc (cb=0x20c) returned 0x7c8e50 [0079.186] SHGetFolderPathW (in: hwnd=0x0, csidl=14, hToken=0x0, dwFlags=0x0, pszPath=0x7c8e50 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned 0x0 [0079.188] CoTaskMemFree (pv=0x7c8e50) [0079.188] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos", nBufferLength=0x105, lpBuffer=0x5bbd4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos", lpFilePart=0x0) returned 0x24 [0079.188] CoTaskMemAlloc (cb=0x20c) returned 0x7c8e50 [0079.188] SHGetFolderPathW (in: hwnd=0x0, csidl=7, hToken=0x0, dwFlags=0x0, pszPath=0x7c8e50 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x0 [0079.190] CoTaskMemFree (pv=0x7c8e50) [0079.190] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", nBufferLength=0x105, lpBuffer=0x5bbd4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpFilePart=0x0) returned 0x5b [0079.190] CoTaskMemAlloc (cb=0x20c) returned 0x7c8e50 [0079.190] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x7c8e50 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0079.190] CoTaskMemFree (pv=0x7c8e50) [0079.190] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", nBufferLength=0x105, lpBuffer=0x5bbd4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d [0079.190] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x5bbd8f4, nSize=0x80 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x1d [0079.190] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x5bbd8f4, nSize=0x80 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x1d [0079.190] GetEnvironmentVariableW (in: lpName="TEMP", lpBuffer=0x5bbd8f4, nSize=0x80 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x24 [0079.595] GetLogicalDrives () returned 0x4 [0079.596] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x5bbebec, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0079.596] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0079.691] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x5bbec38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0079.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf094) returned 1 [0079.691] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x5bbf110 | out: lpFileInformation=0x5bbf110*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf53d33f0, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf53d33f0, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0079.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf090) returned 1 [0079.736] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x5bbec38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0079.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf100) returned 1 [0079.766] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x5bbec08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0079.766] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", nBufferLength=0x105, lpBuffer=0x5bbebdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpFilePart=0x0) returned 0x26 [0079.767] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*", lpFindFileData=0x5bbee28 | out: lpFindFileData=0x5bbee28*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf53d33f0, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf53d33f0, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0079.769] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf53d33f0, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf53d33f0, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.770] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a6e5270, ftCreationTime.dwHighDateTime=0x1d5dfb6, ftLastAccessTime.dwLowDateTime=0x7de2ea50, ftLastAccessTime.dwHighDateTime=0x1d5e70a, ftLastWriteTime.dwLowDateTime=0x7de2ea50, ftLastWriteTime.dwHighDateTime=0x1d5e70a, nFileSizeHigh=0x0, nFileSizeLow=0xb426, dwReserved0=0x0, dwReserved1=0x0, cFileName="4Hph0mkGuJ.png", cAlternateFileName="4HPH0M~1.PNG")) returned 1 [0079.770] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4e8230, ftCreationTime.dwHighDateTime=0x1d5dc95, ftLastAccessTime.dwLowDateTime=0x742ce0d0, ftLastAccessTime.dwHighDateTime=0x1d5e609, ftLastWriteTime.dwLowDateTime=0x742ce0d0, ftLastWriteTime.dwHighDateTime=0x1d5e609, nFileSizeHigh=0x0, nFileSizeLow=0x151c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6VhbS.odp", cAlternateFileName="")) returned 1 [0079.770] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x669e1540, ftCreationTime.dwHighDateTime=0x1d5e32c, ftLastAccessTime.dwLowDateTime=0x754cf1c0, ftLastAccessTime.dwHighDateTime=0x1d5dfb1, ftLastWriteTime.dwLowDateTime=0x754cf1c0, ftLastWriteTime.dwHighDateTime=0x1d5dfb1, nFileSizeHigh=0x0, nFileSizeLow=0x9b7d, dwReserved0=0x0, dwReserved1=0x0, cFileName="aF4ak9s5Zj.png", cAlternateFileName="AF4AK9~1.PNG")) returned 1 [0079.770] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b818280, ftCreationTime.dwHighDateTime=0x1d5dc2d, ftLastAccessTime.dwLowDateTime=0xc580d80, ftLastAccessTime.dwHighDateTime=0x1d5e65a, ftLastWriteTime.dwLowDateTime=0xc580d80, ftLastWriteTime.dwHighDateTime=0x1d5e65a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AJk y95ObVpcDBO Afy", cAlternateFileName="AJKY95~1")) returned 1 [0079.771] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad0d1e0, ftCreationTime.dwHighDateTime=0x1d5e4cc, ftLastAccessTime.dwLowDateTime=0x9e5c110, ftLastAccessTime.dwHighDateTime=0x1d5e672, ftLastWriteTime.dwLowDateTime=0x9e5c110, ftLastWriteTime.dwHighDateTime=0x1d5e672, nFileSizeHigh=0x0, nFileSizeLow=0x7f30, dwReserved0=0x0, dwReserved1=0x0, cFileName="aTaNSARGW1v.gif", cAlternateFileName="ATANSA~1.GIF")) returned 1 [0079.771] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fd86630, ftCreationTime.dwHighDateTime=0x1d5e1e3, ftLastAccessTime.dwLowDateTime=0x934884a0, ftLastAccessTime.dwHighDateTime=0x1d5d9bc, ftLastWriteTime.dwLowDateTime=0x934884a0, ftLastWriteTime.dwHighDateTime=0x1d5d9bc, nFileSizeHigh=0x0, nFileSizeLow=0x11705, dwReserved0=0x0, dwReserved1=0x0, cFileName="C6byuV6XtynN.rtf", cAlternateFileName="C6BYUV~1.RTF")) returned 1 [0079.771] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1b9b320, ftCreationTime.dwHighDateTime=0x1d5e7df, ftLastAccessTime.dwLowDateTime=0x47a567d0, ftLastAccessTime.dwHighDateTime=0x1d5daf6, ftLastWriteTime.dwLowDateTime=0x47a567d0, ftLastWriteTime.dwHighDateTime=0x1d5daf6, nFileSizeHigh=0x0, nFileSizeLow=0x8d0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="D-jGT39_f IU2oK3.bmp", cAlternateFileName="D-JGT3~1.BMP")) returned 1 [0079.771] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0079.771] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f759230, ftCreationTime.dwHighDateTime=0x1d5db18, ftLastAccessTime.dwLowDateTime=0x48883c90, ftLastAccessTime.dwHighDateTime=0x1d5e7c1, ftLastWriteTime.dwLowDateTime=0x48883c90, ftLastWriteTime.dwHighDateTime=0x1d5e7c1, nFileSizeHigh=0x0, nFileSizeLow=0x6b5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="DG-HM.png", cAlternateFileName="")) returned 1 [0079.771] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x501a42c0, ftCreationTime.dwHighDateTime=0x1d5dbcb, ftLastAccessTime.dwLowDateTime=0xa0856710, ftLastAccessTime.dwHighDateTime=0x1d5e325, ftLastWriteTime.dwLowDateTime=0xa0856710, ftLastWriteTime.dwHighDateTime=0x1d5e325, nFileSizeHigh=0x0, nFileSizeLow=0xc6c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="diA8WTV8099_fCYwbmU.wav", cAlternateFileName="DIA8WT~1.WAV")) returned 1 [0079.772] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x373de680, ftCreationTime.dwHighDateTime=0x1d5e45e, ftLastAccessTime.dwLowDateTime=0x7d7c73a0, ftLastAccessTime.dwHighDateTime=0x1d5db12, ftLastWriteTime.dwLowDateTime=0x7d7c73a0, ftLastWriteTime.dwHighDateTime=0x1d5db12, nFileSizeHigh=0x0, nFileSizeLow=0x14386, dwReserved0=0x0, dwReserved1=0x0, cFileName="eMjc3dpU8XkVXHNYo.flv", cAlternateFileName="EMJC3D~1.FLV")) returned 1 [0079.772] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc9eeb00, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xcd378180, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0x9cefe300, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x223200, dwReserved0=0x0, dwReserved1=0x0, cFileName="FallGuysStats.exe", cAlternateFileName="FALLGU~1.EXE")) returned 1 [0079.772] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef3477f0, ftCreationTime.dwHighDateTime=0x1d5e5a7, ftLastAccessTime.dwLowDateTime=0x6678f370, ftLastAccessTime.dwHighDateTime=0x1d5d7db, ftLastWriteTime.dwLowDateTime=0x6678f370, ftLastWriteTime.dwHighDateTime=0x1d5d7db, nFileSizeHigh=0x0, nFileSizeLow=0x148b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="HWLR41UsrzX.pptx", cAlternateFileName="HWLR41~1.PPT")) returned 1 [0079.772] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722d7e70, ftCreationTime.dwHighDateTime=0x1d5dea2, ftLastAccessTime.dwLowDateTime=0x920c1a10, ftLastAccessTime.dwHighDateTime=0x1d5e49e, ftLastWriteTime.dwLowDateTime=0x920c1a10, ftLastWriteTime.dwHighDateTime=0x1d5e49e, nFileSizeHigh=0x0, nFileSizeLow=0x351b, dwReserved0=0x0, dwReserved1=0x0, cFileName="iyhY.mp4", cAlternateFileName="")) returned 1 [0079.772] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70499090, ftCreationTime.dwHighDateTime=0x1d5db9f, ftLastAccessTime.dwLowDateTime=0x18ac2870, ftLastAccessTime.dwHighDateTime=0x1d5d81b, ftLastWriteTime.dwLowDateTime=0x18ac2870, ftLastWriteTime.dwHighDateTime=0x1d5d81b, nFileSizeHigh=0x0, nFileSizeLow=0x3a1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="JEeSx_ 9c9l- M8yaw9.mp3", cAlternateFileName="JEESX_~1.MP3")) returned 1 [0079.772] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x927e0f30, ftCreationTime.dwHighDateTime=0x1d5e471, ftLastAccessTime.dwLowDateTime=0xd28423a0, ftLastAccessTime.dwHighDateTime=0x1d5dc4f, ftLastWriteTime.dwLowDateTime=0xd28423a0, ftLastWriteTime.dwHighDateTime=0x1d5dc4f, nFileSizeHigh=0x0, nFileSizeLow=0x2d52, dwReserved0=0x0, dwReserved1=0x0, cFileName="jyGkOjSXtCmGVH0F.flv", cAlternateFileName="JYGKOJ~1.FLV")) returned 1 [0079.773] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf53d33f0, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf53d33f0, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf53d33f0, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="keys.util", cAlternateFileName="KEYS~1.UTI")) returned 1 [0079.773] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd54276c0, ftCreationTime.dwHighDateTime=0x1d5e125, ftLastAccessTime.dwLowDateTime=0x7ab4fe00, ftLastAccessTime.dwHighDateTime=0x1d5d7d7, ftLastWriteTime.dwLowDateTime=0x7ab4fe00, ftLastWriteTime.dwHighDateTime=0x1d5d7d7, nFileSizeHigh=0x0, nFileSizeLow=0x286c, dwReserved0=0x0, dwReserved1=0x0, cFileName="K_170ChSv1u8Vj1yUw.odt", cAlternateFileName="K_170C~1.ODT")) returned 1 [0079.773] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7149920, ftCreationTime.dwHighDateTime=0x1d5dbbd, ftLastAccessTime.dwLowDateTime=0x6e0fb1a0, ftLastAccessTime.dwHighDateTime=0x1d5deca, ftLastWriteTime.dwLowDateTime=0x6e0fb1a0, ftLastWriteTime.dwHighDateTime=0x1d5deca, nFileSizeHigh=0x0, nFileSizeLow=0x16573, dwReserved0=0x0, dwReserved1=0x0, cFileName="mSwEUqKSIVcu36KpT8Y.ods", cAlternateFileName="MSWEUQ~1.ODS")) returned 1 [0079.773] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe24b440, ftCreationTime.dwHighDateTime=0x1d5db2f, ftLastAccessTime.dwLowDateTime=0x9164bda0, ftLastAccessTime.dwHighDateTime=0x1d5db76, ftLastWriteTime.dwLowDateTime=0x9164bda0, ftLastWriteTime.dwHighDateTime=0x1d5db76, nFileSizeHigh=0x0, nFileSizeLow=0x5d37, dwReserved0=0x0, dwReserved1=0x0, cFileName="NO7u6Yfyqd9wc.mp3", cAlternateFileName="NO7U6Y~1.MP3")) returned 1 [0079.773] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2f1f10, ftCreationTime.dwHighDateTime=0x1d5e512, ftLastAccessTime.dwLowDateTime=0xd6f68e10, ftLastAccessTime.dwHighDateTime=0x1d5e022, ftLastWriteTime.dwLowDateTime=0xd6f68e10, ftLastWriteTime.dwHighDateTime=0x1d5e022, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QyYi21xnW_Hs", cAlternateFileName="QYYI21~1")) returned 1 [0079.773] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x472f8790, ftCreationTime.dwHighDateTime=0x1d5e596, ftLastAccessTime.dwLowDateTime=0xfd11f140, ftLastAccessTime.dwHighDateTime=0x1d5d945, ftLastWriteTime.dwLowDateTime=0xfd11f140, ftLastWriteTime.dwHighDateTime=0x1d5d945, nFileSizeHigh=0x0, nFileSizeLow=0x18341, dwReserved0=0x0, dwReserved1=0x0, cFileName="S 2cbp.jpg", cAlternateFileName="S2CBP~1.JPG")) returned 1 [0079.774] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e8e710, ftCreationTime.dwHighDateTime=0x1d5dd49, ftLastAccessTime.dwLowDateTime=0x183af1b0, ftLastAccessTime.dwHighDateTime=0x1d5da2c, ftLastWriteTime.dwLowDateTime=0x183af1b0, ftLastWriteTime.dwHighDateTime=0x1d5da2c, nFileSizeHigh=0x0, nFileSizeLow=0x43f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="s-MR_A2we.gif", cAlternateFileName="S-MR_A~1.GIF")) returned 1 [0079.774] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf7d97a0, ftCreationTime.dwHighDateTime=0x1d5dbd1, ftLastAccessTime.dwLowDateTime=0xfb5b0470, ftLastAccessTime.dwHighDateTime=0x1d5e725, ftLastWriteTime.dwLowDateTime=0xfb5b0470, ftLastWriteTime.dwHighDateTime=0x1d5e725, nFileSizeHigh=0x0, nFileSizeLow=0x276c, dwReserved0=0x0, dwReserved1=0x0, cFileName="t7KMjQW9rs.png", cAlternateFileName="T7KMJQ~1.PNG")) returned 1 [0079.774] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a2791e0, ftCreationTime.dwHighDateTime=0x1d5de6a, ftLastAccessTime.dwLowDateTime=0xc53c3130, ftLastAccessTime.dwHighDateTime=0x1d5e12a, ftLastWriteTime.dwLowDateTime=0xc53c3130, ftLastWriteTime.dwHighDateTime=0x1d5e12a, nFileSizeHigh=0x0, nFileSizeLow=0x12eac, dwReserved0=0x0, dwReserved1=0x0, cFileName="U8a-Bvcs2ejV.gif", cAlternateFileName="U8A-BV~1.GIF")) returned 1 [0079.774] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a5289e0, ftCreationTime.dwHighDateTime=0x1d5da34, ftLastAccessTime.dwLowDateTime=0xa893c5a0, ftLastAccessTime.dwHighDateTime=0x1d5d952, ftLastWriteTime.dwLowDateTime=0xa893c5a0, ftLastWriteTime.dwHighDateTime=0x1d5d952, nFileSizeHigh=0x0, nFileSizeLow=0x18c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="vuBP6YU W3.swf", cAlternateFileName="VUBP6Y~1.SWF")) returned 1 [0079.775] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6a29c0, ftCreationTime.dwHighDateTime=0x1d5dd3e, ftLastAccessTime.dwLowDateTime=0xabe7e010, ftLastAccessTime.dwHighDateTime=0x1d5e47e, ftLastWriteTime.dwLowDateTime=0xabe7e010, ftLastWriteTime.dwHighDateTime=0x1d5e47e, nFileSizeHigh=0x0, nFileSizeLow=0x4579, dwReserved0=0x0, dwReserved1=0x0, cFileName="W LzDN.swf", cAlternateFileName="WLZDN~1.SWF")) returned 1 [0079.775] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7b87b10, ftCreationTime.dwHighDateTime=0x1d5e096, ftLastAccessTime.dwLowDateTime=0xf9882e00, ftLastAccessTime.dwHighDateTime=0x1d5e137, ftLastWriteTime.dwLowDateTime=0xf9882e00, ftLastWriteTime.dwHighDateTime=0x1d5e137, nFileSizeHigh=0x0, nFileSizeLow=0x1e6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Xgzj4ebzFpd5Qrb6.mkv", cAlternateFileName="XGZJ4E~1.MKV")) returned 1 [0079.775] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb52f8740, ftCreationTime.dwHighDateTime=0x1d5db82, ftLastAccessTime.dwLowDateTime=0x64e3530, ftLastAccessTime.dwHighDateTime=0x1d5d8fa, ftLastWriteTime.dwLowDateTime=0x64e3530, ftLastWriteTime.dwHighDateTime=0x1d5d8fa, nFileSizeHigh=0x0, nFileSizeLow=0x17751, dwReserved0=0x0, dwReserved1=0x0, cFileName="ym 5FDhP_5 -I5BcVgl3.wav", cAlternateFileName="YM5FDH~1.WAV")) returned 1 [0079.775] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb52f8740, ftCreationTime.dwHighDateTime=0x1d5db82, ftLastAccessTime.dwLowDateTime=0x64e3530, ftLastAccessTime.dwHighDateTime=0x1d5d8fa, ftLastWriteTime.dwLowDateTime=0x64e3530, ftLastWriteTime.dwHighDateTime=0x1d5d8fa, nFileSizeHigh=0x0, nFileSizeLow=0x17751, dwReserved0=0x0, dwReserved1=0x0, cFileName="ym 5FDhP_5 -I5BcVgl3.wav", cAlternateFileName="YM5FDH~1.WAV")) returned 0 [0079.775] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0079.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf0c0) returned 1 [0079.776] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf0cc) returned 1 [0079.776] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\.", nBufferLength=0x105, lpBuffer=0x5bbebc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy", lpFilePart=0x0) returned 0x39 [0079.776] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy", nBufferLength=0x105, lpBuffer=0x5bbebf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy", lpFilePart=0x0) returned 0x39 [0079.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf050) returned 1 [0079.776] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ajk y95obvpcdbo afy"), fInfoLevelId=0x0, lpFileInformation=0x5bbf0cc | out: lpFileInformation=0x5bbf0cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b818280, ftCreationTime.dwHighDateTime=0x1d5dc2d, ftLastAccessTime.dwLowDateTime=0xc580d80, ftLastAccessTime.dwHighDateTime=0x1d5e65a, ftLastWriteTime.dwLowDateTime=0xc580d80, ftLastWriteTime.dwHighDateTime=0x1d5e65a, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0079.776] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf04c) returned 1 [0079.776] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy", nBufferLength=0x105, lpBuffer=0x5bbebf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy", lpFilePart=0x0) returned 0x39 [0079.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf0bc) returned 1 [0079.777] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy", nBufferLength=0x105, lpBuffer=0x5bbebc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy", lpFilePart=0x0) returned 0x39 [0079.777] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\", nBufferLength=0x105, lpBuffer=0x5bbeb98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\", lpFilePart=0x0) returned 0x3a [0079.777] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\*", lpFindFileData=0x5bbede4 | out: lpFindFileData=0x5bbede4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b818280, ftCreationTime.dwHighDateTime=0x1d5dc2d, ftLastAccessTime.dwLowDateTime=0xc580d80, ftLastAccessTime.dwHighDateTime=0x1d5e65a, ftLastWriteTime.dwLowDateTime=0xc580d80, ftLastWriteTime.dwHighDateTime=0x1d5e65a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0079.777] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b818280, ftCreationTime.dwHighDateTime=0x1d5dc2d, ftLastAccessTime.dwLowDateTime=0xc580d80, ftLastAccessTime.dwHighDateTime=0x1d5e65a, ftLastWriteTime.dwLowDateTime=0xc580d80, ftLastWriteTime.dwHighDateTime=0x1d5e65a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.777] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe07b19e0, ftCreationTime.dwHighDateTime=0x1d5e70e, ftLastAccessTime.dwLowDateTime=0xe4d74e10, ftLastAccessTime.dwHighDateTime=0x1d5df79, ftLastWriteTime.dwLowDateTime=0xe4d74e10, ftLastWriteTime.dwHighDateTime=0x1d5df79, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AuZZq-okf vUlJtyNYH", cAlternateFileName="AUZZQ-~1")) returned 1 [0079.777] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de344d0, ftCreationTime.dwHighDateTime=0x1d5e4ad, ftLastAccessTime.dwLowDateTime=0xa7bf7b90, ftLastAccessTime.dwHighDateTime=0x1d5d8d7, ftLastWriteTime.dwLowDateTime=0xa7bf7b90, ftLastWriteTime.dwHighDateTime=0x1d5d8d7, nFileSizeHigh=0x0, nFileSizeLow=0xf108, dwReserved0=0x0, dwReserved1=0x0, cFileName="b9FcVnoFNC.png", cAlternateFileName="B9FCVN~1.PNG")) returned 1 [0079.777] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc15503a0, ftCreationTime.dwHighDateTime=0x1d5e2e5, ftLastAccessTime.dwLowDateTime=0xc148c5d0, ftLastAccessTime.dwHighDateTime=0x1d5e5de, ftLastWriteTime.dwLowDateTime=0xc148c5d0, ftLastWriteTime.dwHighDateTime=0x1d5e5de, nFileSizeHigh=0x0, nFileSizeLow=0x9d49, dwReserved0=0x0, dwReserved1=0x0, cFileName="dtXt_TmK9II.mkv", cAlternateFileName="DTXT_T~1.MKV")) returned 1 [0079.778] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75f4d130, ftCreationTime.dwHighDateTime=0x1d5e338, ftLastAccessTime.dwLowDateTime=0x189f490, ftLastAccessTime.dwHighDateTime=0x1d5d935, ftLastWriteTime.dwLowDateTime=0x189f490, ftLastWriteTime.dwHighDateTime=0x1d5d935, nFileSizeHigh=0x0, nFileSizeLow=0x8fdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="jr_Gv20FMbSShkbmmV.png", cAlternateFileName="JR_GV2~1.PNG")) returned 1 [0079.778] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x337eeb30, ftCreationTime.dwHighDateTime=0x1d5e2c8, ftLastAccessTime.dwLowDateTime=0x31e3eeb0, ftLastAccessTime.dwHighDateTime=0x1d5d99a, ftLastWriteTime.dwLowDateTime=0x31e3eeb0, ftLastWriteTime.dwHighDateTime=0x1d5d99a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uq3rwC", cAlternateFileName="")) returned 1 [0079.778] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x548ac960, ftCreationTime.dwHighDateTime=0x1d5e378, ftLastAccessTime.dwLowDateTime=0xe166edc0, ftLastAccessTime.dwHighDateTime=0x1d5dd7c, ftLastWriteTime.dwLowDateTime=0xe166edc0, ftLastWriteTime.dwHighDateTime=0x1d5dd7c, nFileSizeHigh=0x0, nFileSizeLow=0x1317, dwReserved0=0x0, dwReserved1=0x0, cFileName="wodHX9Xmfd7UDCz.png", cAlternateFileName="WODHX9~1.PNG")) returned 1 [0079.779] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17e0fd0, ftCreationTime.dwHighDateTime=0x1d5dc51, ftLastAccessTime.dwLowDateTime=0xe4af0e90, ftLastAccessTime.dwHighDateTime=0x1d5e187, ftLastWriteTime.dwLowDateTime=0xe4af0e90, ftLastWriteTime.dwHighDateTime=0x1d5e187, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_WnqDTffVXM", cAlternateFileName="_WNQDT~1")) returned 1 [0079.779] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0079.779] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0079.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf07c) returned 1 [0079.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf088) returned 1 [0079.779] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\AuZZq-okf vUlJtyNYH\\.", nBufferLength=0x105, lpBuffer=0x5bbeb7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\AuZZq-okf vUlJtyNYH", lpFilePart=0x0) returned 0x4d [0079.779] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\AuZZq-okf vUlJtyNYH", nBufferLength=0x105, lpBuffer=0x5bbebb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\AuZZq-okf vUlJtyNYH", lpFilePart=0x0) returned 0x4d [0079.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf00c) returned 1 [0079.780] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\AuZZq-okf vUlJtyNYH" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ajk y95obvpcdbo afy\\auzzq-okf vuljtynyh"), fInfoLevelId=0x0, lpFileInformation=0x5bbf088 | out: lpFileInformation=0x5bbf088*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe07b19e0, ftCreationTime.dwHighDateTime=0x1d5e70e, ftLastAccessTime.dwLowDateTime=0xe4d74e10, ftLastAccessTime.dwHighDateTime=0x1d5df79, ftLastWriteTime.dwLowDateTime=0xe4d74e10, ftLastWriteTime.dwHighDateTime=0x1d5df79, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0079.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf008) returned 1 [0079.780] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\AuZZq-okf vUlJtyNYH", nBufferLength=0x105, lpBuffer=0x5bbebb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\AuZZq-okf vUlJtyNYH", lpFilePart=0x0) returned 0x4d [0079.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf078) returned 1 [0079.780] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\AuZZq-okf vUlJtyNYH", nBufferLength=0x105, lpBuffer=0x5bbeb80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\AuZZq-okf vUlJtyNYH", lpFilePart=0x0) returned 0x4d [0079.780] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\AuZZq-okf vUlJtyNYH\\", nBufferLength=0x105, lpBuffer=0x5bbeb54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\AuZZq-okf vUlJtyNYH\\", lpFilePart=0x0) returned 0x4e [0079.780] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\AuZZq-okf vUlJtyNYH\\*", lpFindFileData=0x5bbeda0 | out: lpFindFileData=0x5bbeda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe07b19e0, ftCreationTime.dwHighDateTime=0x1d5e70e, ftLastAccessTime.dwLowDateTime=0xe4d74e10, ftLastAccessTime.dwHighDateTime=0x1d5df79, ftLastWriteTime.dwLowDateTime=0xe4d74e10, ftLastWriteTime.dwHighDateTime=0x1d5df79, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0079.780] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe07b19e0, ftCreationTime.dwHighDateTime=0x1d5e70e, ftLastAccessTime.dwLowDateTime=0xe4d74e10, ftLastAccessTime.dwHighDateTime=0x1d5df79, ftLastWriteTime.dwLowDateTime=0xe4d74e10, ftLastWriteTime.dwHighDateTime=0x1d5df79, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.781] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a1b610, ftCreationTime.dwHighDateTime=0x1d5e364, ftLastAccessTime.dwLowDateTime=0x9e227780, ftLastAccessTime.dwHighDateTime=0x1d5d806, ftLastWriteTime.dwLowDateTime=0x9e227780, ftLastWriteTime.dwHighDateTime=0x1d5d806, nFileSizeHigh=0x0, nFileSizeLow=0xc3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ohJPpkFw.mp3", cAlternateFileName="")) returned 1 [0079.781] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe034e4a0, ftCreationTime.dwHighDateTime=0x1d5e125, ftLastAccessTime.dwLowDateTime=0x8da4f600, ftLastAccessTime.dwHighDateTime=0x1d5df25, ftLastWriteTime.dwLowDateTime=0x8da4f600, ftLastWriteTime.dwHighDateTime=0x1d5df25, nFileSizeHigh=0x0, nFileSizeLow=0xe971, dwReserved0=0x0, dwReserved1=0x0, cFileName="om7flqxt.mp4", cAlternateFileName="")) returned 1 [0079.781] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d9e3a20, ftCreationTime.dwHighDateTime=0x1d5d96a, ftLastAccessTime.dwLowDateTime=0x95d06140, ftLastAccessTime.dwHighDateTime=0x1d5e59f, ftLastWriteTime.dwLowDateTime=0x95d06140, ftLastWriteTime.dwHighDateTime=0x1d5e59f, nFileSizeHigh=0x0, nFileSizeLow=0x17f6d, dwReserved0=0x0, dwReserved1=0x0, cFileName="xhE625YkY.mp3", cAlternateFileName="XHE625~1.MP3")) returned 1 [0079.781] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc31e0940, ftCreationTime.dwHighDateTime=0x1d5e716, ftLastAccessTime.dwLowDateTime=0x67c47510, ftLastAccessTime.dwHighDateTime=0x1d5dfc4, ftLastWriteTime.dwLowDateTime=0x67c47510, ftLastWriteTime.dwHighDateTime=0x1d5dfc4, nFileSizeHigh=0x0, nFileSizeLow=0x16257, dwReserved0=0x0, dwReserved1=0x0, cFileName="xOVlScoP915_.bmp", cAlternateFileName="XOVLSC~1.BMP")) returned 1 [0079.782] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc31e0940, ftCreationTime.dwHighDateTime=0x1d5e716, ftLastAccessTime.dwLowDateTime=0x67c47510, ftLastAccessTime.dwHighDateTime=0x1d5dfc4, ftLastWriteTime.dwLowDateTime=0x67c47510, ftLastWriteTime.dwHighDateTime=0x1d5dfc4, nFileSizeHigh=0x0, nFileSizeLow=0x16257, dwReserved0=0x0, dwReserved1=0x0, cFileName="xOVlScoP915_.bmp", cAlternateFileName="XOVLSC~1.BMP")) returned 0 [0079.782] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0079.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf038) returned 1 [0079.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf044) returned 1 [0079.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf078) returned 1 [0079.782] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\AuZZq-okf vUlJtyNYH", nBufferLength=0x105, lpBuffer=0x5bbeb80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\AuZZq-okf vUlJtyNYH", lpFilePart=0x0) returned 0x4d [0079.782] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\AuZZq-okf vUlJtyNYH\\", nBufferLength=0x105, lpBuffer=0x5bbeb54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\AuZZq-okf vUlJtyNYH\\", lpFilePart=0x0) returned 0x4e [0079.782] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\AuZZq-okf vUlJtyNYH\\*", lpFindFileData=0x5bbeda0 | out: lpFindFileData=0x5bbeda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe07b19e0, ftCreationTime.dwHighDateTime=0x1d5e70e, ftLastAccessTime.dwLowDateTime=0xe4d74e10, ftLastAccessTime.dwHighDateTime=0x1d5df79, ftLastWriteTime.dwLowDateTime=0xe4d74e10, ftLastWriteTime.dwHighDateTime=0x1d5df79, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0079.783] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe07b19e0, ftCreationTime.dwHighDateTime=0x1d5e70e, ftLastAccessTime.dwLowDateTime=0xe4d74e10, ftLastAccessTime.dwHighDateTime=0x1d5df79, ftLastWriteTime.dwLowDateTime=0xe4d74e10, ftLastWriteTime.dwHighDateTime=0x1d5df79, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.784] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a1b610, ftCreationTime.dwHighDateTime=0x1d5e364, ftLastAccessTime.dwLowDateTime=0x9e227780, ftLastAccessTime.dwHighDateTime=0x1d5d806, ftLastWriteTime.dwLowDateTime=0x9e227780, ftLastWriteTime.dwHighDateTime=0x1d5d806, nFileSizeHigh=0x0, nFileSizeLow=0xc3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ohJPpkFw.mp3", cAlternateFileName="")) returned 1 [0079.784] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe034e4a0, ftCreationTime.dwHighDateTime=0x1d5e125, ftLastAccessTime.dwLowDateTime=0x8da4f600, ftLastAccessTime.dwHighDateTime=0x1d5df25, ftLastWriteTime.dwLowDateTime=0x8da4f600, ftLastWriteTime.dwHighDateTime=0x1d5df25, nFileSizeHigh=0x0, nFileSizeLow=0xe971, dwReserved0=0x0, dwReserved1=0x0, cFileName="om7flqxt.mp4", cAlternateFileName="")) returned 1 [0079.784] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d9e3a20, ftCreationTime.dwHighDateTime=0x1d5d96a, ftLastAccessTime.dwLowDateTime=0x95d06140, ftLastAccessTime.dwHighDateTime=0x1d5e59f, ftLastWriteTime.dwLowDateTime=0x95d06140, ftLastWriteTime.dwHighDateTime=0x1d5e59f, nFileSizeHigh=0x0, nFileSizeLow=0x17f6d, dwReserved0=0x0, dwReserved1=0x0, cFileName="xhE625YkY.mp3", cAlternateFileName="XHE625~1.MP3")) returned 1 [0079.784] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc31e0940, ftCreationTime.dwHighDateTime=0x1d5e716, ftLastAccessTime.dwLowDateTime=0x67c47510, ftLastAccessTime.dwHighDateTime=0x1d5dfc4, ftLastWriteTime.dwLowDateTime=0x67c47510, ftLastWriteTime.dwHighDateTime=0x1d5dfc4, nFileSizeHigh=0x0, nFileSizeLow=0x16257, dwReserved0=0x0, dwReserved1=0x0, cFileName="xOVlScoP915_.bmp", cAlternateFileName="XOVLSC~1.BMP")) returned 1 [0079.784] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0079.785] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0079.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf038) returned 1 [0079.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf044) returned 1 [0079.785] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\Uq3rwC\\.", nBufferLength=0x105, lpBuffer=0x5bbeb7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\Uq3rwC", lpFilePart=0x0) returned 0x40 [0079.785] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\Uq3rwC", nBufferLength=0x105, lpBuffer=0x5bbebb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\Uq3rwC", lpFilePart=0x0) returned 0x40 [0079.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf00c) returned 1 [0079.785] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\Uq3rwC" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ajk y95obvpcdbo afy\\uq3rwc"), fInfoLevelId=0x0, lpFileInformation=0x5bbf088 | out: lpFileInformation=0x5bbf088*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x337eeb30, ftCreationTime.dwHighDateTime=0x1d5e2c8, ftLastAccessTime.dwLowDateTime=0x31e3eeb0, ftLastAccessTime.dwHighDateTime=0x1d5d99a, ftLastWriteTime.dwLowDateTime=0x31e3eeb0, ftLastWriteTime.dwHighDateTime=0x1d5d99a, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0079.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf008) returned 1 [0079.785] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\Uq3rwC", nBufferLength=0x105, lpBuffer=0x5bbebb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\Uq3rwC", lpFilePart=0x0) returned 0x40 [0079.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf078) returned 1 [0079.785] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\Uq3rwC", nBufferLength=0x105, lpBuffer=0x5bbeb80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\Uq3rwC", lpFilePart=0x0) returned 0x40 [0079.785] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\Uq3rwC\\", nBufferLength=0x105, lpBuffer=0x5bbeb54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\Uq3rwC\\", lpFilePart=0x0) returned 0x41 [0079.786] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\Uq3rwC\\*", lpFindFileData=0x5bbeda0 | out: lpFindFileData=0x5bbeda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x337eeb30, ftCreationTime.dwHighDateTime=0x1d5e2c8, ftLastAccessTime.dwLowDateTime=0x31e3eeb0, ftLastAccessTime.dwHighDateTime=0x1d5d99a, ftLastWriteTime.dwLowDateTime=0x31e3eeb0, ftLastWriteTime.dwHighDateTime=0x1d5d99a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0079.786] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x337eeb30, ftCreationTime.dwHighDateTime=0x1d5e2c8, ftLastAccessTime.dwLowDateTime=0x31e3eeb0, ftLastAccessTime.dwHighDateTime=0x1d5d99a, ftLastWriteTime.dwLowDateTime=0x31e3eeb0, ftLastWriteTime.dwHighDateTime=0x1d5d99a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.786] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e9d64f0, ftCreationTime.dwHighDateTime=0x1d5e68d, ftLastAccessTime.dwLowDateTime=0xd4f10f20, ftLastAccessTime.dwHighDateTime=0x1d5d995, ftLastWriteTime.dwLowDateTime=0xd4f10f20, ftLastWriteTime.dwHighDateTime=0x1d5d995, nFileSizeHigh=0x0, nFileSizeLow=0x15baa, dwReserved0=0x0, dwReserved1=0x0, cFileName="2JjYy7rxle2WdAkomW s.xls", cAlternateFileName="2JJYY7~1.XLS")) returned 1 [0079.786] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e94e0, ftCreationTime.dwHighDateTime=0x1d5db00, ftLastAccessTime.dwLowDateTime=0xf749aeb0, ftLastAccessTime.dwHighDateTime=0x1d5e624, ftLastWriteTime.dwLowDateTime=0xf749aeb0, ftLastWriteTime.dwHighDateTime=0x1d5e624, nFileSizeHigh=0x0, nFileSizeLow=0x14a3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="aPp84FH_N_-UhGsI un.m4a", cAlternateFileName="APP84F~1.M4A")) returned 1 [0079.786] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x942b9b10, ftCreationTime.dwHighDateTime=0x1d5e514, ftLastAccessTime.dwLowDateTime=0x2b62c210, ftLastAccessTime.dwHighDateTime=0x1d5e2b8, ftLastWriteTime.dwLowDateTime=0x2b62c210, ftLastWriteTime.dwHighDateTime=0x1d5e2b8, nFileSizeHigh=0x0, nFileSizeLow=0xfa35, dwReserved0=0x0, dwReserved1=0x0, cFileName="F5m01gnCVKQ4f.jpg", cAlternateFileName="F5M01G~1.JPG")) returned 1 [0079.787] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x236004b0, ftCreationTime.dwHighDateTime=0x1d5e466, ftLastAccessTime.dwLowDateTime=0x30cde0, ftLastAccessTime.dwHighDateTime=0x1d5dcfe, ftLastWriteTime.dwLowDateTime=0x30cde0, ftLastWriteTime.dwHighDateTime=0x1d5dcfe, nFileSizeHigh=0x0, nFileSizeLow=0xa98d, dwReserved0=0x0, dwReserved1=0x0, cFileName="TwCHyQGTPo_wKDp.m4a", cAlternateFileName="TWCHYQ~1.M4A")) returned 1 [0079.787] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc66e6d0, ftCreationTime.dwHighDateTime=0x1d5e6e4, ftLastAccessTime.dwLowDateTime=0xfe04a340, ftLastAccessTime.dwHighDateTime=0x1d5d814, ftLastWriteTime.dwLowDateTime=0xfe04a340, ftLastWriteTime.dwHighDateTime=0x1d5d814, nFileSizeHigh=0x0, nFileSizeLow=0x15ef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zyg_m58v ambKcCP.ods", cAlternateFileName="ZYG_M5~1.ODS")) returned 1 [0079.787] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc66e6d0, ftCreationTime.dwHighDateTime=0x1d5e6e4, ftLastAccessTime.dwLowDateTime=0xfe04a340, ftLastAccessTime.dwHighDateTime=0x1d5d814, ftLastWriteTime.dwLowDateTime=0xfe04a340, ftLastWriteTime.dwHighDateTime=0x1d5d814, nFileSizeHigh=0x0, nFileSizeLow=0x15ef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zyg_m58v ambKcCP.ods", cAlternateFileName="ZYG_M5~1.ODS")) returned 0 [0079.787] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0079.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf038) returned 1 [0079.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf044) returned 1 [0079.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf078) returned 1 [0079.787] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\Uq3rwC", nBufferLength=0x105, lpBuffer=0x5bbeb80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\Uq3rwC", lpFilePart=0x0) returned 0x40 [0079.788] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\Uq3rwC\\", nBufferLength=0x105, lpBuffer=0x5bbeb54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\Uq3rwC\\", lpFilePart=0x0) returned 0x41 [0079.788] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\Uq3rwC\\*", lpFindFileData=0x5bbeda0 | out: lpFindFileData=0x5bbeda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x337eeb30, ftCreationTime.dwHighDateTime=0x1d5e2c8, ftLastAccessTime.dwLowDateTime=0x31e3eeb0, ftLastAccessTime.dwHighDateTime=0x1d5d99a, ftLastWriteTime.dwLowDateTime=0x31e3eeb0, ftLastWriteTime.dwHighDateTime=0x1d5d99a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0079.788] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x337eeb30, ftCreationTime.dwHighDateTime=0x1d5e2c8, ftLastAccessTime.dwLowDateTime=0x31e3eeb0, ftLastAccessTime.dwHighDateTime=0x1d5d99a, ftLastWriteTime.dwLowDateTime=0x31e3eeb0, ftLastWriteTime.dwHighDateTime=0x1d5d99a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.788] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e9d64f0, ftCreationTime.dwHighDateTime=0x1d5e68d, ftLastAccessTime.dwLowDateTime=0xd4f10f20, ftLastAccessTime.dwHighDateTime=0x1d5d995, ftLastWriteTime.dwLowDateTime=0xd4f10f20, ftLastWriteTime.dwHighDateTime=0x1d5d995, nFileSizeHigh=0x0, nFileSizeLow=0x15baa, dwReserved0=0x0, dwReserved1=0x0, cFileName="2JjYy7rxle2WdAkomW s.xls", cAlternateFileName="2JJYY7~1.XLS")) returned 1 [0079.788] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e94e0, ftCreationTime.dwHighDateTime=0x1d5db00, ftLastAccessTime.dwLowDateTime=0xf749aeb0, ftLastAccessTime.dwHighDateTime=0x1d5e624, ftLastWriteTime.dwLowDateTime=0xf749aeb0, ftLastWriteTime.dwHighDateTime=0x1d5e624, nFileSizeHigh=0x0, nFileSizeLow=0x14a3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="aPp84FH_N_-UhGsI un.m4a", cAlternateFileName="APP84F~1.M4A")) returned 1 [0079.788] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x942b9b10, ftCreationTime.dwHighDateTime=0x1d5e514, ftLastAccessTime.dwLowDateTime=0x2b62c210, ftLastAccessTime.dwHighDateTime=0x1d5e2b8, ftLastWriteTime.dwLowDateTime=0x2b62c210, ftLastWriteTime.dwHighDateTime=0x1d5e2b8, nFileSizeHigh=0x0, nFileSizeLow=0xfa35, dwReserved0=0x0, dwReserved1=0x0, cFileName="F5m01gnCVKQ4f.jpg", cAlternateFileName="F5M01G~1.JPG")) returned 1 [0079.789] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x236004b0, ftCreationTime.dwHighDateTime=0x1d5e466, ftLastAccessTime.dwLowDateTime=0x30cde0, ftLastAccessTime.dwHighDateTime=0x1d5dcfe, ftLastWriteTime.dwLowDateTime=0x30cde0, ftLastWriteTime.dwHighDateTime=0x1d5dcfe, nFileSizeHigh=0x0, nFileSizeLow=0xa98d, dwReserved0=0x0, dwReserved1=0x0, cFileName="TwCHyQGTPo_wKDp.m4a", cAlternateFileName="TWCHYQ~1.M4A")) returned 1 [0079.789] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc66e6d0, ftCreationTime.dwHighDateTime=0x1d5e6e4, ftLastAccessTime.dwLowDateTime=0xfe04a340, ftLastAccessTime.dwHighDateTime=0x1d5d814, ftLastWriteTime.dwLowDateTime=0xfe04a340, ftLastWriteTime.dwHighDateTime=0x1d5d814, nFileSizeHigh=0x0, nFileSizeLow=0x15ef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zyg_m58v ambKcCP.ods", cAlternateFileName="ZYG_M5~1.ODS")) returned 1 [0079.789] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0079.789] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0079.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf038) returned 1 [0079.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf044) returned 1 [0079.789] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\_WnqDTffVXM\\.", nBufferLength=0x105, lpBuffer=0x5bbeb7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\_WnqDTffVXM", lpFilePart=0x0) returned 0x45 [0079.789] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\_WnqDTffVXM", nBufferLength=0x105, lpBuffer=0x5bbebb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\_WnqDTffVXM", lpFilePart=0x0) returned 0x45 [0079.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf00c) returned 1 [0079.790] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\_WnqDTffVXM" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ajk y95obvpcdbo afy\\_wnqdtffvxm"), fInfoLevelId=0x0, lpFileInformation=0x5bbf088 | out: lpFileInformation=0x5bbf088*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17e0fd0, ftCreationTime.dwHighDateTime=0x1d5dc51, ftLastAccessTime.dwLowDateTime=0xe4af0e90, ftLastAccessTime.dwHighDateTime=0x1d5e187, ftLastWriteTime.dwLowDateTime=0xe4af0e90, ftLastWriteTime.dwHighDateTime=0x1d5e187, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0079.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf008) returned 1 [0079.790] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\_WnqDTffVXM", nBufferLength=0x105, lpBuffer=0x5bbebb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\_WnqDTffVXM", lpFilePart=0x0) returned 0x45 [0079.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf078) returned 1 [0079.790] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\_WnqDTffVXM", nBufferLength=0x105, lpBuffer=0x5bbeb80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\_WnqDTffVXM", lpFilePart=0x0) returned 0x45 [0079.790] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\_WnqDTffVXM\\", nBufferLength=0x105, lpBuffer=0x5bbeb54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\_WnqDTffVXM\\", lpFilePart=0x0) returned 0x46 [0079.790] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\_WnqDTffVXM\\*", lpFindFileData=0x5bbeda0 | out: lpFindFileData=0x5bbeda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17e0fd0, ftCreationTime.dwHighDateTime=0x1d5dc51, ftLastAccessTime.dwLowDateTime=0xe4af0e90, ftLastAccessTime.dwHighDateTime=0x1d5e187, ftLastWriteTime.dwLowDateTime=0xe4af0e90, ftLastWriteTime.dwHighDateTime=0x1d5e187, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0079.911] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17e0fd0, ftCreationTime.dwHighDateTime=0x1d5dc51, ftLastAccessTime.dwLowDateTime=0xe4af0e90, ftLastAccessTime.dwHighDateTime=0x1d5e187, ftLastWriteTime.dwLowDateTime=0xe4af0e90, ftLastWriteTime.dwHighDateTime=0x1d5e187, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.911] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe53680, ftCreationTime.dwHighDateTime=0x1d5e410, ftLastAccessTime.dwLowDateTime=0x4b30b560, ftLastAccessTime.dwHighDateTime=0x1d5e7c3, ftLastWriteTime.dwLowDateTime=0x4b30b560, ftLastWriteTime.dwHighDateTime=0x1d5e7c3, nFileSizeHigh=0x0, nFileSizeLow=0x9de1, dwReserved0=0x0, dwReserved1=0x0, cFileName="8ClBY-7rWT.mkv", cAlternateFileName="8CLBY-~1.MKV")) returned 1 [0079.911] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4357c1b0, ftCreationTime.dwHighDateTime=0x1d5e540, ftLastAccessTime.dwLowDateTime=0x9a1f1cf0, ftLastAccessTime.dwHighDateTime=0x1d5e365, ftLastWriteTime.dwLowDateTime=0x9a1f1cf0, ftLastWriteTime.dwHighDateTime=0x1d5e365, nFileSizeHigh=0x0, nFileSizeLow=0x4a57, dwReserved0=0x0, dwReserved1=0x0, cFileName="AMrby_.m4a", cAlternateFileName="")) returned 1 [0079.911] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbd17100, ftCreationTime.dwHighDateTime=0x1d5de94, ftLastAccessTime.dwLowDateTime=0x3f96a9f0, ftLastAccessTime.dwHighDateTime=0x1d5d92a, ftLastWriteTime.dwLowDateTime=0x3f96a9f0, ftLastWriteTime.dwHighDateTime=0x1d5d92a, nFileSizeHigh=0x0, nFileSizeLow=0x123ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="VItfp_0jxaA wfc.swf", cAlternateFileName="VITFP_~1.SWF")) returned 1 [0079.912] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed6f2440, ftCreationTime.dwHighDateTime=0x1d5e315, ftLastAccessTime.dwLowDateTime=0xa45e2d00, ftLastAccessTime.dwHighDateTime=0x1d5df0a, ftLastWriteTime.dwLowDateTime=0xa45e2d00, ftLastWriteTime.dwHighDateTime=0x1d5df0a, nFileSizeHigh=0x0, nFileSizeLow=0x1634a, dwReserved0=0x0, dwReserved1=0x0, cFileName="wCbc0x6XzG5tCFOdr.doc", cAlternateFileName="WCBC0X~1.DOC")) returned 1 [0079.912] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x416af3c0, ftCreationTime.dwHighDateTime=0x1d5e7db, ftLastAccessTime.dwLowDateTime=0x7245f950, ftLastAccessTime.dwHighDateTime=0x1d5e6c2, ftLastWriteTime.dwLowDateTime=0x7245f950, ftLastWriteTime.dwHighDateTime=0x1d5e6c2, nFileSizeHigh=0x0, nFileSizeLow=0x116a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="xdHXoGNV31A1y39U7l.avi", cAlternateFileName="XDHXOG~1.AVI")) returned 1 [0079.912] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x416af3c0, ftCreationTime.dwHighDateTime=0x1d5e7db, ftLastAccessTime.dwLowDateTime=0x7245f950, ftLastAccessTime.dwHighDateTime=0x1d5e6c2, ftLastWriteTime.dwLowDateTime=0x7245f950, ftLastWriteTime.dwHighDateTime=0x1d5e6c2, nFileSizeHigh=0x0, nFileSizeLow=0x116a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="xdHXoGNV31A1y39U7l.avi", cAlternateFileName="XDHXOG~1.AVI")) returned 0 [0079.912] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0079.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf038) returned 1 [0079.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf044) returned 1 [0079.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf078) returned 1 [0079.913] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\_WnqDTffVXM", nBufferLength=0x105, lpBuffer=0x5bbeb80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\_WnqDTffVXM", lpFilePart=0x0) returned 0x45 [0079.913] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\_WnqDTffVXM\\", nBufferLength=0x105, lpBuffer=0x5bbeb54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\_WnqDTffVXM\\", lpFilePart=0x0) returned 0x46 [0079.913] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\_WnqDTffVXM\\*", lpFindFileData=0x5bbeda0 | out: lpFindFileData=0x5bbeda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17e0fd0, ftCreationTime.dwHighDateTime=0x1d5dc51, ftLastAccessTime.dwLowDateTime=0xe4af0e90, ftLastAccessTime.dwHighDateTime=0x1d5e187, ftLastWriteTime.dwLowDateTime=0xe4af0e90, ftLastWriteTime.dwHighDateTime=0x1d5e187, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0079.913] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17e0fd0, ftCreationTime.dwHighDateTime=0x1d5dc51, ftLastAccessTime.dwLowDateTime=0xe4af0e90, ftLastAccessTime.dwHighDateTime=0x1d5e187, ftLastWriteTime.dwLowDateTime=0xe4af0e90, ftLastWriteTime.dwHighDateTime=0x1d5e187, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.914] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe53680, ftCreationTime.dwHighDateTime=0x1d5e410, ftLastAccessTime.dwLowDateTime=0x4b30b560, ftLastAccessTime.dwHighDateTime=0x1d5e7c3, ftLastWriteTime.dwLowDateTime=0x4b30b560, ftLastWriteTime.dwHighDateTime=0x1d5e7c3, nFileSizeHigh=0x0, nFileSizeLow=0x9de1, dwReserved0=0x0, dwReserved1=0x0, cFileName="8ClBY-7rWT.mkv", cAlternateFileName="8CLBY-~1.MKV")) returned 1 [0079.914] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4357c1b0, ftCreationTime.dwHighDateTime=0x1d5e540, ftLastAccessTime.dwLowDateTime=0x9a1f1cf0, ftLastAccessTime.dwHighDateTime=0x1d5e365, ftLastWriteTime.dwLowDateTime=0x9a1f1cf0, ftLastWriteTime.dwHighDateTime=0x1d5e365, nFileSizeHigh=0x0, nFileSizeLow=0x4a57, dwReserved0=0x0, dwReserved1=0x0, cFileName="AMrby_.m4a", cAlternateFileName="")) returned 1 [0079.914] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbd17100, ftCreationTime.dwHighDateTime=0x1d5de94, ftLastAccessTime.dwLowDateTime=0x3f96a9f0, ftLastAccessTime.dwHighDateTime=0x1d5d92a, ftLastWriteTime.dwLowDateTime=0x3f96a9f0, ftLastWriteTime.dwHighDateTime=0x1d5d92a, nFileSizeHigh=0x0, nFileSizeLow=0x123ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="VItfp_0jxaA wfc.swf", cAlternateFileName="VITFP_~1.SWF")) returned 1 [0079.914] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed6f2440, ftCreationTime.dwHighDateTime=0x1d5e315, ftLastAccessTime.dwLowDateTime=0xa45e2d00, ftLastAccessTime.dwHighDateTime=0x1d5df0a, ftLastWriteTime.dwLowDateTime=0xa45e2d00, ftLastWriteTime.dwHighDateTime=0x1d5df0a, nFileSizeHigh=0x0, nFileSizeLow=0x1634a, dwReserved0=0x0, dwReserved1=0x0, cFileName="wCbc0x6XzG5tCFOdr.doc", cAlternateFileName="WCBC0X~1.DOC")) returned 1 [0079.915] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x416af3c0, ftCreationTime.dwHighDateTime=0x1d5e7db, ftLastAccessTime.dwLowDateTime=0x7245f950, ftLastAccessTime.dwHighDateTime=0x1d5e6c2, ftLastWriteTime.dwLowDateTime=0x7245f950, ftLastWriteTime.dwHighDateTime=0x1d5e6c2, nFileSizeHigh=0x0, nFileSizeLow=0x116a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="xdHXoGNV31A1y39U7l.avi", cAlternateFileName="XDHXOG~1.AVI")) returned 1 [0079.915] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0079.915] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0079.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf038) returned 1 [0079.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf044) returned 1 [0079.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf0bc) returned 1 [0079.915] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy", nBufferLength=0x105, lpBuffer=0x5bbebc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy", lpFilePart=0x0) returned 0x39 [0079.916] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\", nBufferLength=0x105, lpBuffer=0x5bbeb98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\", lpFilePart=0x0) returned 0x3a [0079.916] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\*", lpFindFileData=0x5bbede4 | out: lpFindFileData=0x5bbede4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b818280, ftCreationTime.dwHighDateTime=0x1d5dc2d, ftLastAccessTime.dwLowDateTime=0xc580d80, ftLastAccessTime.dwHighDateTime=0x1d5e65a, ftLastWriteTime.dwLowDateTime=0xc580d80, ftLastWriteTime.dwHighDateTime=0x1d5e65a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0079.916] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b818280, ftCreationTime.dwHighDateTime=0x1d5dc2d, ftLastAccessTime.dwLowDateTime=0xc580d80, ftLastAccessTime.dwHighDateTime=0x1d5e65a, ftLastWriteTime.dwLowDateTime=0xc580d80, ftLastWriteTime.dwHighDateTime=0x1d5e65a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.916] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe07b19e0, ftCreationTime.dwHighDateTime=0x1d5e70e, ftLastAccessTime.dwLowDateTime=0xe4d74e10, ftLastAccessTime.dwHighDateTime=0x1d5df79, ftLastWriteTime.dwLowDateTime=0xe4d74e10, ftLastWriteTime.dwHighDateTime=0x1d5df79, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AuZZq-okf vUlJtyNYH", cAlternateFileName="AUZZQ-~1")) returned 1 [0079.916] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de344d0, ftCreationTime.dwHighDateTime=0x1d5e4ad, ftLastAccessTime.dwLowDateTime=0xa7bf7b90, ftLastAccessTime.dwHighDateTime=0x1d5d8d7, ftLastWriteTime.dwLowDateTime=0xa7bf7b90, ftLastWriteTime.dwHighDateTime=0x1d5d8d7, nFileSizeHigh=0x0, nFileSizeLow=0xf108, dwReserved0=0x0, dwReserved1=0x0, cFileName="b9FcVnoFNC.png", cAlternateFileName="B9FCVN~1.PNG")) returned 1 [0079.917] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc15503a0, ftCreationTime.dwHighDateTime=0x1d5e2e5, ftLastAccessTime.dwLowDateTime=0xc148c5d0, ftLastAccessTime.dwHighDateTime=0x1d5e5de, ftLastWriteTime.dwLowDateTime=0xc148c5d0, ftLastWriteTime.dwHighDateTime=0x1d5e5de, nFileSizeHigh=0x0, nFileSizeLow=0x9d49, dwReserved0=0x0, dwReserved1=0x0, cFileName="dtXt_TmK9II.mkv", cAlternateFileName="DTXT_T~1.MKV")) returned 1 [0079.917] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75f4d130, ftCreationTime.dwHighDateTime=0x1d5e338, ftLastAccessTime.dwLowDateTime=0x189f490, ftLastAccessTime.dwHighDateTime=0x1d5d935, ftLastWriteTime.dwLowDateTime=0x189f490, ftLastWriteTime.dwHighDateTime=0x1d5d935, nFileSizeHigh=0x0, nFileSizeLow=0x8fdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="jr_Gv20FMbSShkbmmV.png", cAlternateFileName="JR_GV2~1.PNG")) returned 1 [0079.917] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x337eeb30, ftCreationTime.dwHighDateTime=0x1d5e2c8, ftLastAccessTime.dwLowDateTime=0x31e3eeb0, ftLastAccessTime.dwHighDateTime=0x1d5d99a, ftLastWriteTime.dwLowDateTime=0x31e3eeb0, ftLastWriteTime.dwHighDateTime=0x1d5d99a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uq3rwC", cAlternateFileName="")) returned 1 [0079.918] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x548ac960, ftCreationTime.dwHighDateTime=0x1d5e378, ftLastAccessTime.dwLowDateTime=0xe166edc0, ftLastAccessTime.dwHighDateTime=0x1d5dd7c, ftLastWriteTime.dwLowDateTime=0xe166edc0, ftLastWriteTime.dwHighDateTime=0x1d5dd7c, nFileSizeHigh=0x0, nFileSizeLow=0x1317, dwReserved0=0x0, dwReserved1=0x0, cFileName="wodHX9Xmfd7UDCz.png", cAlternateFileName="WODHX9~1.PNG")) returned 1 [0079.918] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17e0fd0, ftCreationTime.dwHighDateTime=0x1d5dc51, ftLastAccessTime.dwLowDateTime=0xe4af0e90, ftLastAccessTime.dwHighDateTime=0x1d5e187, ftLastWriteTime.dwLowDateTime=0xe4af0e90, ftLastWriteTime.dwHighDateTime=0x1d5e187, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_WnqDTffVXM", cAlternateFileName="_WNQDT~1")) returned 1 [0079.918] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17e0fd0, ftCreationTime.dwHighDateTime=0x1d5dc51, ftLastAccessTime.dwLowDateTime=0xe4af0e90, ftLastAccessTime.dwHighDateTime=0x1d5e187, ftLastWriteTime.dwLowDateTime=0xe4af0e90, ftLastWriteTime.dwHighDateTime=0x1d5e187, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_WnqDTffVXM", cAlternateFileName="_WNQDT~1")) returned 0 [0079.918] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0079.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf07c) returned 1 [0079.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf088) returned 1 [0079.919] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QyYi21xnW_Hs\\.", nBufferLength=0x105, lpBuffer=0x5bbebc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QyYi21xnW_Hs", lpFilePart=0x0) returned 0x32 [0079.919] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QyYi21xnW_Hs", nBufferLength=0x105, lpBuffer=0x5bbebf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QyYi21xnW_Hs", lpFilePart=0x0) returned 0x32 [0079.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf050) returned 1 [0079.919] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QyYi21xnW_Hs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qyyi21xnw_hs"), fInfoLevelId=0x0, lpFileInformation=0x5bbf0cc | out: lpFileInformation=0x5bbf0cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2f1f10, ftCreationTime.dwHighDateTime=0x1d5e512, ftLastAccessTime.dwLowDateTime=0xd6f68e10, ftLastAccessTime.dwHighDateTime=0x1d5e022, ftLastWriteTime.dwLowDateTime=0xd6f68e10, ftLastWriteTime.dwHighDateTime=0x1d5e022, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0080.122] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf04c) returned 1 [0080.122] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QyYi21xnW_Hs", nBufferLength=0x105, lpBuffer=0x5bbebf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QyYi21xnW_Hs", lpFilePart=0x0) returned 0x32 [0080.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf0bc) returned 1 [0080.123] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QyYi21xnW_Hs", nBufferLength=0x105, lpBuffer=0x5bbebc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QyYi21xnW_Hs", lpFilePart=0x0) returned 0x32 [0080.123] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QyYi21xnW_Hs\\", nBufferLength=0x105, lpBuffer=0x5bbeb98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QyYi21xnW_Hs\\", lpFilePart=0x0) returned 0x33 [0080.123] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QyYi21xnW_Hs\\*", lpFindFileData=0x5bbede4 | out: lpFindFileData=0x5bbede4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2f1f10, ftCreationTime.dwHighDateTime=0x1d5e512, ftLastAccessTime.dwLowDateTime=0xd6f68e10, ftLastAccessTime.dwHighDateTime=0x1d5e022, ftLastWriteTime.dwLowDateTime=0xd6f68e10, ftLastWriteTime.dwHighDateTime=0x1d5e022, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0080.123] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2f1f10, ftCreationTime.dwHighDateTime=0x1d5e512, ftLastAccessTime.dwLowDateTime=0xd6f68e10, ftLastAccessTime.dwHighDateTime=0x1d5e022, ftLastWriteTime.dwLowDateTime=0xd6f68e10, ftLastWriteTime.dwHighDateTime=0x1d5e022, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.124] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2f1f10, ftCreationTime.dwHighDateTime=0x1d5e512, ftLastAccessTime.dwLowDateTime=0xd6f68e10, ftLastAccessTime.dwHighDateTime=0x1d5e022, ftLastWriteTime.dwLowDateTime=0xd6f68e10, ftLastWriteTime.dwHighDateTime=0x1d5e022, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0080.124] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0080.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf07c) returned 1 [0080.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf088) returned 1 [0080.124] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf0bc) returned 1 [0080.124] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QyYi21xnW_Hs", nBufferLength=0x105, lpBuffer=0x5bbebc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QyYi21xnW_Hs", lpFilePart=0x0) returned 0x32 [0080.124] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QyYi21xnW_Hs\\", nBufferLength=0x105, lpBuffer=0x5bbeb98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QyYi21xnW_Hs\\", lpFilePart=0x0) returned 0x33 [0080.124] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QyYi21xnW_Hs\\*", lpFindFileData=0x5bbede4 | out: lpFindFileData=0x5bbede4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2f1f10, ftCreationTime.dwHighDateTime=0x1d5e512, ftLastAccessTime.dwLowDateTime=0xd6f68e10, ftLastAccessTime.dwHighDateTime=0x1d5e022, ftLastWriteTime.dwLowDateTime=0xd6f68e10, ftLastWriteTime.dwHighDateTime=0x1d5e022, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0080.124] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2f1f10, ftCreationTime.dwHighDateTime=0x1d5e512, ftLastAccessTime.dwLowDateTime=0xd6f68e10, ftLastAccessTime.dwHighDateTime=0x1d5e022, ftLastWriteTime.dwLowDateTime=0xd6f68e10, ftLastWriteTime.dwHighDateTime=0x1d5e022, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.125] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2f1f10, ftCreationTime.dwHighDateTime=0x1d5e512, ftLastAccessTime.dwLowDateTime=0xd6f68e10, ftLastAccessTime.dwHighDateTime=0x1d5e022, ftLastWriteTime.dwLowDateTime=0xd6f68e10, ftLastWriteTime.dwHighDateTime=0x1d5e022, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0080.125] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0080.125] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf07c) returned 1 [0080.125] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf088) returned 1 [0080.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf100) returned 1 [0080.125] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x5bbec08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0080.125] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", nBufferLength=0x105, lpBuffer=0x5bbebdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpFilePart=0x0) returned 0x26 [0080.125] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*", lpFindFileData=0x5bbee28 | out: lpFindFileData=0x5bbee28*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf53d33f0, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf53d33f0, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0080.125] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf53d33f0, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf53d33f0, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.125] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a6e5270, ftCreationTime.dwHighDateTime=0x1d5dfb6, ftLastAccessTime.dwLowDateTime=0x7de2ea50, ftLastAccessTime.dwHighDateTime=0x1d5e70a, ftLastWriteTime.dwLowDateTime=0x7de2ea50, ftLastWriteTime.dwHighDateTime=0x1d5e70a, nFileSizeHigh=0x0, nFileSizeLow=0xb426, dwReserved0=0x0, dwReserved1=0x0, cFileName="4Hph0mkGuJ.png", cAlternateFileName="4HPH0M~1.PNG")) returned 1 [0080.125] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4e8230, ftCreationTime.dwHighDateTime=0x1d5dc95, ftLastAccessTime.dwLowDateTime=0x742ce0d0, ftLastAccessTime.dwHighDateTime=0x1d5e609, ftLastWriteTime.dwLowDateTime=0x742ce0d0, ftLastWriteTime.dwHighDateTime=0x1d5e609, nFileSizeHigh=0x0, nFileSizeLow=0x151c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6VhbS.odp", cAlternateFileName="")) returned 1 [0080.126] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x669e1540, ftCreationTime.dwHighDateTime=0x1d5e32c, ftLastAccessTime.dwLowDateTime=0x754cf1c0, ftLastAccessTime.dwHighDateTime=0x1d5dfb1, ftLastWriteTime.dwLowDateTime=0x754cf1c0, ftLastWriteTime.dwHighDateTime=0x1d5dfb1, nFileSizeHigh=0x0, nFileSizeLow=0x9b7d, dwReserved0=0x0, dwReserved1=0x0, cFileName="aF4ak9s5Zj.png", cAlternateFileName="AF4AK9~1.PNG")) returned 1 [0080.126] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b818280, ftCreationTime.dwHighDateTime=0x1d5dc2d, ftLastAccessTime.dwLowDateTime=0xc580d80, ftLastAccessTime.dwHighDateTime=0x1d5e65a, ftLastWriteTime.dwLowDateTime=0xc580d80, ftLastWriteTime.dwHighDateTime=0x1d5e65a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AJk y95ObVpcDBO Afy", cAlternateFileName="AJKY95~1")) returned 1 [0080.126] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad0d1e0, ftCreationTime.dwHighDateTime=0x1d5e4cc, ftLastAccessTime.dwLowDateTime=0x9e5c110, ftLastAccessTime.dwHighDateTime=0x1d5e672, ftLastWriteTime.dwLowDateTime=0x9e5c110, ftLastWriteTime.dwHighDateTime=0x1d5e672, nFileSizeHigh=0x0, nFileSizeLow=0x7f30, dwReserved0=0x0, dwReserved1=0x0, cFileName="aTaNSARGW1v.gif", cAlternateFileName="ATANSA~1.GIF")) returned 1 [0080.126] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fd86630, ftCreationTime.dwHighDateTime=0x1d5e1e3, ftLastAccessTime.dwLowDateTime=0x934884a0, ftLastAccessTime.dwHighDateTime=0x1d5d9bc, ftLastWriteTime.dwLowDateTime=0x934884a0, ftLastWriteTime.dwHighDateTime=0x1d5d9bc, nFileSizeHigh=0x0, nFileSizeLow=0x11705, dwReserved0=0x0, dwReserved1=0x0, cFileName="C6byuV6XtynN.rtf", cAlternateFileName="C6BYUV~1.RTF")) returned 1 [0080.127] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1b9b320, ftCreationTime.dwHighDateTime=0x1d5e7df, ftLastAccessTime.dwLowDateTime=0x47a567d0, ftLastAccessTime.dwHighDateTime=0x1d5daf6, ftLastWriteTime.dwLowDateTime=0x47a567d0, ftLastWriteTime.dwHighDateTime=0x1d5daf6, nFileSizeHigh=0x0, nFileSizeLow=0x8d0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="D-jGT39_f IU2oK3.bmp", cAlternateFileName="D-JGT3~1.BMP")) returned 1 [0080.127] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0080.127] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f759230, ftCreationTime.dwHighDateTime=0x1d5db18, ftLastAccessTime.dwLowDateTime=0x48883c90, ftLastAccessTime.dwHighDateTime=0x1d5e7c1, ftLastWriteTime.dwLowDateTime=0x48883c90, ftLastWriteTime.dwHighDateTime=0x1d5e7c1, nFileSizeHigh=0x0, nFileSizeLow=0x6b5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="DG-HM.png", cAlternateFileName="")) returned 1 [0080.127] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x501a42c0, ftCreationTime.dwHighDateTime=0x1d5dbcb, ftLastAccessTime.dwLowDateTime=0xa0856710, ftLastAccessTime.dwHighDateTime=0x1d5e325, ftLastWriteTime.dwLowDateTime=0xa0856710, ftLastWriteTime.dwHighDateTime=0x1d5e325, nFileSizeHigh=0x0, nFileSizeLow=0xc6c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="diA8WTV8099_fCYwbmU.wav", cAlternateFileName="DIA8WT~1.WAV")) returned 1 [0080.127] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x373de680, ftCreationTime.dwHighDateTime=0x1d5e45e, ftLastAccessTime.dwLowDateTime=0x7d7c73a0, ftLastAccessTime.dwHighDateTime=0x1d5db12, ftLastWriteTime.dwLowDateTime=0x7d7c73a0, ftLastWriteTime.dwHighDateTime=0x1d5db12, nFileSizeHigh=0x0, nFileSizeLow=0x14386, dwReserved0=0x0, dwReserved1=0x0, cFileName="eMjc3dpU8XkVXHNYo.flv", cAlternateFileName="EMJC3D~1.FLV")) returned 1 [0080.127] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc9eeb00, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xcd378180, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0x9cefe300, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x223200, dwReserved0=0x0, dwReserved1=0x0, cFileName="FallGuysStats.exe", cAlternateFileName="FALLGU~1.EXE")) returned 1 [0080.127] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef3477f0, ftCreationTime.dwHighDateTime=0x1d5e5a7, ftLastAccessTime.dwLowDateTime=0x6678f370, ftLastAccessTime.dwHighDateTime=0x1d5d7db, ftLastWriteTime.dwLowDateTime=0x6678f370, ftLastWriteTime.dwHighDateTime=0x1d5d7db, nFileSizeHigh=0x0, nFileSizeLow=0x148b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="HWLR41UsrzX.pptx", cAlternateFileName="HWLR41~1.PPT")) returned 1 [0080.128] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722d7e70, ftCreationTime.dwHighDateTime=0x1d5dea2, ftLastAccessTime.dwLowDateTime=0x920c1a10, ftLastAccessTime.dwHighDateTime=0x1d5e49e, ftLastWriteTime.dwLowDateTime=0x920c1a10, ftLastWriteTime.dwHighDateTime=0x1d5e49e, nFileSizeHigh=0x0, nFileSizeLow=0x351b, dwReserved0=0x0, dwReserved1=0x0, cFileName="iyhY.mp4", cAlternateFileName="")) returned 1 [0080.128] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70499090, ftCreationTime.dwHighDateTime=0x1d5db9f, ftLastAccessTime.dwLowDateTime=0x18ac2870, ftLastAccessTime.dwHighDateTime=0x1d5d81b, ftLastWriteTime.dwLowDateTime=0x18ac2870, ftLastWriteTime.dwHighDateTime=0x1d5d81b, nFileSizeHigh=0x0, nFileSizeLow=0x3a1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="JEeSx_ 9c9l- M8yaw9.mp3", cAlternateFileName="JEESX_~1.MP3")) returned 1 [0080.128] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x927e0f30, ftCreationTime.dwHighDateTime=0x1d5e471, ftLastAccessTime.dwLowDateTime=0xd28423a0, ftLastAccessTime.dwHighDateTime=0x1d5dc4f, ftLastWriteTime.dwLowDateTime=0xd28423a0, ftLastWriteTime.dwHighDateTime=0x1d5dc4f, nFileSizeHigh=0x0, nFileSizeLow=0x2d52, dwReserved0=0x0, dwReserved1=0x0, cFileName="jyGkOjSXtCmGVH0F.flv", cAlternateFileName="JYGKOJ~1.FLV")) returned 1 [0080.128] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xf53d33f0, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf53d33f0, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf55e8730, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x8d800, dwReserved0=0x0, dwReserved1=0x0, cFileName="keys.util", cAlternateFileName="KEYS~1.UTI")) returned 1 [0080.128] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd54276c0, ftCreationTime.dwHighDateTime=0x1d5e125, ftLastAccessTime.dwLowDateTime=0x7ab4fe00, ftLastAccessTime.dwHighDateTime=0x1d5d7d7, ftLastWriteTime.dwLowDateTime=0x7ab4fe00, ftLastWriteTime.dwHighDateTime=0x1d5d7d7, nFileSizeHigh=0x0, nFileSizeLow=0x286c, dwReserved0=0x0, dwReserved1=0x0, cFileName="K_170ChSv1u8Vj1yUw.odt", cAlternateFileName="K_170C~1.ODT")) returned 1 [0080.128] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7149920, ftCreationTime.dwHighDateTime=0x1d5dbbd, ftLastAccessTime.dwLowDateTime=0x6e0fb1a0, ftLastAccessTime.dwHighDateTime=0x1d5deca, ftLastWriteTime.dwLowDateTime=0x6e0fb1a0, ftLastWriteTime.dwHighDateTime=0x1d5deca, nFileSizeHigh=0x0, nFileSizeLow=0x16573, dwReserved0=0x0, dwReserved1=0x0, cFileName="mSwEUqKSIVcu36KpT8Y.ods", cAlternateFileName="MSWEUQ~1.ODS")) returned 1 [0080.128] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe24b440, ftCreationTime.dwHighDateTime=0x1d5db2f, ftLastAccessTime.dwLowDateTime=0x9164bda0, ftLastAccessTime.dwHighDateTime=0x1d5db76, ftLastWriteTime.dwLowDateTime=0x9164bda0, ftLastWriteTime.dwHighDateTime=0x1d5db76, nFileSizeHigh=0x0, nFileSizeLow=0x5d37, dwReserved0=0x0, dwReserved1=0x0, cFileName="NO7u6Yfyqd9wc.mp3", cAlternateFileName="NO7U6Y~1.MP3")) returned 1 [0080.129] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2f1f10, ftCreationTime.dwHighDateTime=0x1d5e512, ftLastAccessTime.dwLowDateTime=0xd6f68e10, ftLastAccessTime.dwHighDateTime=0x1d5e022, ftLastWriteTime.dwLowDateTime=0xd6f68e10, ftLastWriteTime.dwHighDateTime=0x1d5e022, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QyYi21xnW_Hs", cAlternateFileName="QYYI21~1")) returned 1 [0080.129] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x472f8790, ftCreationTime.dwHighDateTime=0x1d5e596, ftLastAccessTime.dwLowDateTime=0xfd11f140, ftLastAccessTime.dwHighDateTime=0x1d5d945, ftLastWriteTime.dwLowDateTime=0xfd11f140, ftLastWriteTime.dwHighDateTime=0x1d5d945, nFileSizeHigh=0x0, nFileSizeLow=0x18341, dwReserved0=0x0, dwReserved1=0x0, cFileName="S 2cbp.jpg", cAlternateFileName="S2CBP~1.JPG")) returned 1 [0080.129] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e8e710, ftCreationTime.dwHighDateTime=0x1d5dd49, ftLastAccessTime.dwLowDateTime=0x183af1b0, ftLastAccessTime.dwHighDateTime=0x1d5da2c, ftLastWriteTime.dwLowDateTime=0x183af1b0, ftLastWriteTime.dwHighDateTime=0x1d5da2c, nFileSizeHigh=0x0, nFileSizeLow=0x43f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="s-MR_A2we.gif", cAlternateFileName="S-MR_A~1.GIF")) returned 1 [0080.129] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf7d97a0, ftCreationTime.dwHighDateTime=0x1d5dbd1, ftLastAccessTime.dwLowDateTime=0xfb5b0470, ftLastAccessTime.dwHighDateTime=0x1d5e725, ftLastWriteTime.dwLowDateTime=0xfb5b0470, ftLastWriteTime.dwHighDateTime=0x1d5e725, nFileSizeHigh=0x0, nFileSizeLow=0x276c, dwReserved0=0x0, dwReserved1=0x0, cFileName="t7KMjQW9rs.png", cAlternateFileName="T7KMJQ~1.PNG")) returned 1 [0080.129] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a2791e0, ftCreationTime.dwHighDateTime=0x1d5de6a, ftLastAccessTime.dwLowDateTime=0xc53c3130, ftLastAccessTime.dwHighDateTime=0x1d5e12a, ftLastWriteTime.dwLowDateTime=0xc53c3130, ftLastWriteTime.dwHighDateTime=0x1d5e12a, nFileSizeHigh=0x0, nFileSizeLow=0x12eac, dwReserved0=0x0, dwReserved1=0x0, cFileName="U8a-Bvcs2ejV.gif", cAlternateFileName="U8A-BV~1.GIF")) returned 1 [0080.129] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a5289e0, ftCreationTime.dwHighDateTime=0x1d5da34, ftLastAccessTime.dwLowDateTime=0xa893c5a0, ftLastAccessTime.dwHighDateTime=0x1d5d952, ftLastWriteTime.dwLowDateTime=0xa893c5a0, ftLastWriteTime.dwHighDateTime=0x1d5d952, nFileSizeHigh=0x0, nFileSizeLow=0x18c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="vuBP6YU W3.swf", cAlternateFileName="VUBP6Y~1.SWF")) returned 1 [0080.130] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6a29c0, ftCreationTime.dwHighDateTime=0x1d5dd3e, ftLastAccessTime.dwLowDateTime=0xabe7e010, ftLastAccessTime.dwHighDateTime=0x1d5e47e, ftLastWriteTime.dwLowDateTime=0xabe7e010, ftLastWriteTime.dwHighDateTime=0x1d5e47e, nFileSizeHigh=0x0, nFileSizeLow=0x4579, dwReserved0=0x0, dwReserved1=0x0, cFileName="W LzDN.swf", cAlternateFileName="WLZDN~1.SWF")) returned 1 [0080.130] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7b87b10, ftCreationTime.dwHighDateTime=0x1d5e096, ftLastAccessTime.dwLowDateTime=0xf9882e00, ftLastAccessTime.dwHighDateTime=0x1d5e137, ftLastWriteTime.dwLowDateTime=0xf9882e00, ftLastWriteTime.dwHighDateTime=0x1d5e137, nFileSizeHigh=0x0, nFileSizeLow=0x1e6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Xgzj4ebzFpd5Qrb6.mkv", cAlternateFileName="XGZJ4E~1.MKV")) returned 1 [0080.130] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb52f8740, ftCreationTime.dwHighDateTime=0x1d5db82, ftLastAccessTime.dwLowDateTime=0x64e3530, ftLastAccessTime.dwHighDateTime=0x1d5d8fa, ftLastWriteTime.dwLowDateTime=0x64e3530, ftLastWriteTime.dwHighDateTime=0x1d5d8fa, nFileSizeHigh=0x0, nFileSizeLow=0x17751, dwReserved0=0x0, dwReserved1=0x0, cFileName="ym 5FDhP_5 -I5BcVgl3.wav", cAlternateFileName="YM5FDH~1.WAV")) returned 1 [0080.130] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0080.130] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0080.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf0c0) returned 1 [0080.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf0cc) returned 1 [0080.134] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x5bbec6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0080.136] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x5bbeb0c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0080.137] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Desktop.txt", nBufferLength=0x105, lpBuffer=0x5bbeb20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Desktop.txt", lpFilePart=0x0) returned 0x83 [0080.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf014) returned 1 [0080.320] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Desktop.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs\\desktop.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x514 [0080.321] GetFileType (hFile=0x514) returned 0x1 [0080.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf010) returned 1 [0080.321] GetFileType (hFile=0x514) returned 0x1 [0080.322] WriteFile (in: hFile=0x514, lpBuffer=0x26fde20*, nNumberOfBytesToWrite=0x3ef, lpNumberOfBytesWritten=0x5bbf0ac, lpOverlapped=0x0 | out: lpBuffer=0x26fde20*, lpNumberOfBytesWritten=0x5bbf0ac*=0x3ef, lpOverlapped=0x0) returned 1 [0080.323] CloseHandle (hObject=0x514) returned 1 [0080.334] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", nBufferLength=0x105, lpBuffer=0x5bbec38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", lpFilePart=0x0) returned 0x27 [0080.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf094) returned 1 [0080.334] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents"), fInfoLevelId=0x0, lpFileInformation=0x5bbf110 | out: lpFileInformation=0x5bbf110*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdbe2d4a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbe2d4a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0080.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf090) returned 1 [0080.334] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", nBufferLength=0x105, lpBuffer=0x5bbec38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", lpFilePart=0x0) returned 0x27 [0080.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf100) returned 1 [0080.334] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", nBufferLength=0x105, lpBuffer=0x5bbec08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", lpFilePart=0x0) returned 0x27 [0080.334] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", nBufferLength=0x105, lpBuffer=0x5bbebdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", lpFilePart=0x0) returned 0x28 [0080.334] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*", lpFindFileData=0x5bbee28 | out: lpFindFileData=0x5bbee28*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdbe2d4a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbe2d4a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0080.334] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdbe2d4a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbe2d4a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.335] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc0cd120, ftCreationTime.dwHighDateTime=0x1d58431, ftLastAccessTime.dwLowDateTime=0xdea7f8a0, ftLastAccessTime.dwHighDateTime=0x1d5c4c1, ftLastWriteTime.dwLowDateTime=0xdea7f8a0, ftLastWriteTime.dwHighDateTime=0x1d5c4c1, nFileSizeHigh=0x0, nFileSizeLow=0x677e, dwReserved0=0x0, dwReserved1=0x0, cFileName="8-y4LOfY.xlsx", cAlternateFileName="8-Y4LO~1.XLS")) returned 1 [0080.335] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4363460, ftCreationTime.dwHighDateTime=0x1d57957, ftLastAccessTime.dwLowDateTime=0x84e126c0, ftLastAccessTime.dwHighDateTime=0x1d5e65e, ftLastWriteTime.dwLowDateTime=0x84e126c0, ftLastWriteTime.dwHighDateTime=0x1d5e65e, nFileSizeHigh=0x0, nFileSizeLow=0x11d97, dwReserved0=0x0, dwReserved1=0x0, cFileName="82nzDGjI 7XWXV_l.xlsx", cAlternateFileName="82NZDG~1.XLS")) returned 1 [0080.335] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40528c90, ftCreationTime.dwHighDateTime=0x1d5ae0c, ftLastAccessTime.dwLowDateTime=0x47d76e50, ftLastAccessTime.dwHighDateTime=0x1d56608, ftLastWriteTime.dwLowDateTime=0x47d76e50, ftLastWriteTime.dwHighDateTime=0x1d56608, nFileSizeHigh=0x0, nFileSizeLow=0xc77f, dwReserved0=0x0, dwReserved1=0x0, cFileName="8nrt26S7PviA02dyk.pptx", cAlternateFileName="8NRT26~1.PPT")) returned 1 [0080.335] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bb6c3f0, ftCreationTime.dwHighDateTime=0x1d55b36, ftLastAccessTime.dwLowDateTime=0x94f6d9a0, ftLastAccessTime.dwHighDateTime=0x1d5a6b3, ftLastWriteTime.dwLowDateTime=0x94f6d9a0, ftLastWriteTime.dwHighDateTime=0x1d5a6b3, nFileSizeHigh=0x0, nFileSizeLow=0x10517, dwReserved0=0x0, dwReserved1=0x0, cFileName="aV3XYxvgegC.docx", cAlternateFileName="AV3XYX~1.DOC")) returned 1 [0080.335] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddba0680, ftCreationTime.dwHighDateTime=0x1d5e3cb, ftLastAccessTime.dwLowDateTime=0xe835b1c0, ftLastAccessTime.dwHighDateTime=0x1d5e1de, ftLastWriteTime.dwLowDateTime=0xe835b1c0, ftLastWriteTime.dwHighDateTime=0x1d5e1de, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="b80m5N3teF4Nk1P", cAlternateFileName="B80M5N~1")) returned 1 [0080.336] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0080.336] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fbfcc80, ftCreationTime.dwHighDateTime=0x1d5b650, ftLastAccessTime.dwLowDateTime=0x7a8995f0, ftLastAccessTime.dwHighDateTime=0x1d5dee2, ftLastWriteTime.dwLowDateTime=0x7a8995f0, ftLastWriteTime.dwHighDateTime=0x1d5dee2, nFileSizeHigh=0x0, nFileSizeLow=0x12ca8, dwReserved0=0x0, dwReserved1=0x0, cFileName="gcBW 4OQaj.pptx", cAlternateFileName="GCBW4O~1.PPT")) returned 1 [0080.336] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4727ea0, ftCreationTime.dwHighDateTime=0x1d5a84b, ftLastAccessTime.dwLowDateTime=0x9643e170, ftLastAccessTime.dwHighDateTime=0x1d56d2b, ftLastWriteTime.dwLowDateTime=0x9643e170, ftLastWriteTime.dwHighDateTime=0x1d56d2b, nFileSizeHigh=0x0, nFileSizeLow=0xc01d, dwReserved0=0x0, dwReserved1=0x0, cFileName="gqp9rLKCCKsd05.docx", cAlternateFileName="GQP9RL~1.DOC")) returned 1 [0080.336] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0f4c730, ftCreationTime.dwHighDateTime=0x1d5d912, ftLastAccessTime.dwLowDateTime=0x4ee4cfe0, ftLastAccessTime.dwHighDateTime=0x1d5d871, ftLastWriteTime.dwLowDateTime=0x4ee4cfe0, ftLastWriteTime.dwHighDateTime=0x1d5d871, nFileSizeHigh=0x0, nFileSizeLow=0x133a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="h8I86FUVFr.docx", cAlternateFileName="H8I86F~1.DOC")) returned 1 [0080.336] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7fcb00, ftCreationTime.dwHighDateTime=0x1d5c170, ftLastAccessTime.dwLowDateTime=0x55e037b0, ftLastAccessTime.dwHighDateTime=0x1d5d297, ftLastWriteTime.dwLowDateTime=0x55e037b0, ftLastWriteTime.dwHighDateTime=0x1d5d297, nFileSizeHigh=0x0, nFileSizeLow=0x16388, dwReserved0=0x0, dwReserved1=0x0, cFileName="jQFpDdnAiB98NT.docx", cAlternateFileName="JQFPDD~1.DOC")) returned 1 [0080.337] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec194c0, ftCreationTime.dwHighDateTime=0x1d58036, ftLastAccessTime.dwLowDateTime=0xc3abd700, ftLastAccessTime.dwHighDateTime=0x1d5de26, ftLastWriteTime.dwLowDateTime=0xc3abd700, ftLastWriteTime.dwHighDateTime=0x1d5de26, nFileSizeHigh=0x0, nFileSizeLow=0x1303d, dwReserved0=0x0, dwReserved1=0x0, cFileName="KskcceHMsX7rT.xlsx", cAlternateFileName="KSKCCE~1.XLS")) returned 1 [0080.337] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0080.337] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0080.337] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0080.337] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0080.337] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ddcd580, ftCreationTime.dwHighDateTime=0x1d5a5f2, ftLastAccessTime.dwLowDateTime=0xea013500, ftLastAccessTime.dwHighDateTime=0x1d56160, ftLastWriteTime.dwLowDateTime=0xea013500, ftLastWriteTime.dwHighDateTime=0x1d56160, nFileSizeHigh=0x0, nFileSizeLow=0xd513, dwReserved0=0x0, dwReserved1=0x0, cFileName="nlXNmDoCq.pptx", cAlternateFileName="NLXNMD~1.PPT")) returned 1 [0080.338] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5f72ff0, ftCreationTime.dwHighDateTime=0x1d5a3ea, ftLastAccessTime.dwLowDateTime=0x76911260, ftLastAccessTime.dwHighDateTime=0x1d5a8ba, ftLastWriteTime.dwLowDateTime=0x76911260, ftLastWriteTime.dwHighDateTime=0x1d5a8ba, nFileSizeHigh=0x0, nFileSizeLow=0x1190c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oiYNJq9q1YIrgX.docx", cAlternateFileName="OIYNJQ~1.DOC")) returned 1 [0080.338] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8a4af3c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8a4af3c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0080.338] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedc3a100, ftCreationTime.dwHighDateTime=0x1d5dfa0, ftLastAccessTime.dwLowDateTime=0x63e311d0, ftLastAccessTime.dwHighDateTime=0x1d5db06, ftLastWriteTime.dwLowDateTime=0x63e311d0, ftLastWriteTime.dwHighDateTime=0x1d5db06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oX2xE8wIX", cAlternateFileName="OX2XE8~1")) returned 1 [0080.338] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78e00870, ftCreationTime.dwHighDateTime=0x1d59ca6, ftLastAccessTime.dwLowDateTime=0xb4a95c30, ftLastAccessTime.dwHighDateTime=0x1d580bd, ftLastWriteTime.dwLowDateTime=0xb4a95c30, ftLastWriteTime.dwHighDateTime=0x1d580bd, nFileSizeHigh=0x0, nFileSizeLow=0x930d, dwReserved0=0x0, dwReserved1=0x0, cFileName="PFyZqu_bN8iiDcWbYu.docx", cAlternateFileName="PFYZQU~1.DOC")) returned 1 [0080.338] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe817f210, ftCreationTime.dwHighDateTime=0x1d5e7e8, ftLastAccessTime.dwLowDateTime=0xf4cbeb50, ftLastAccessTime.dwHighDateTime=0x1d57ba6, ftLastWriteTime.dwLowDateTime=0xf4cbeb50, ftLastWriteTime.dwHighDateTime=0x1d57ba6, nFileSizeHigh=0x0, nFileSizeLow=0x178c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qAMKrJ s5aXEM2 DfBx.xlsx", cAlternateFileName="QAMKRJ~1.XLS")) returned 1 [0080.339] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a2ea540, ftCreationTime.dwHighDateTime=0x1d5da48, ftLastAccessTime.dwLowDateTime=0x52cdcad0, ftLastAccessTime.dwHighDateTime=0x1d5db9b, ftLastWriteTime.dwLowDateTime=0x52cdcad0, ftLastWriteTime.dwHighDateTime=0x1d5db9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QmUng5_ZXRVu", cAlternateFileName="QMUNG5~1")) returned 1 [0080.339] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a7ac60, ftCreationTime.dwHighDateTime=0x1d5e050, ftLastAccessTime.dwLowDateTime=0x44695690, ftLastAccessTime.dwHighDateTime=0x1d5d8fc, ftLastWriteTime.dwLowDateTime=0x44695690, ftLastWriteTime.dwHighDateTime=0x1d5d8fc, nFileSizeHigh=0x0, nFileSizeLow=0x11028, dwReserved0=0x0, dwReserved1=0x0, cFileName="R6MuKWr660ExY0xOP1YZ.doc", cAlternateFileName="R6MUKW~1.DOC")) returned 1 [0080.339] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x827cc010, ftCreationTime.dwHighDateTime=0x1d5d95c, ftLastAccessTime.dwLowDateTime=0x2b1954f0, ftLastAccessTime.dwHighDateTime=0x1d5def2, ftLastWriteTime.dwLowDateTime=0x2b1954f0, ftLastWriteTime.dwHighDateTime=0x1d5def2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rIREdumyZRX80jt2", cAlternateFileName="RIREDU~1")) returned 1 [0080.339] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdecb2f10, ftCreationTime.dwHighDateTime=0x1d5d8ac, ftLastAccessTime.dwLowDateTime=0x93a8cb30, ftLastAccessTime.dwHighDateTime=0x1d5bafe, ftLastWriteTime.dwLowDateTime=0x93a8cb30, ftLastWriteTime.dwHighDateTime=0x1d5bafe, nFileSizeHigh=0x0, nFileSizeLow=0x67cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RPane0VXyl-S.pptx", cAlternateFileName="RPANE0~1.PPT")) returned 1 [0080.339] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbeb1ff0, ftCreationTime.dwHighDateTime=0x1d568b4, ftLastAccessTime.dwLowDateTime=0x55cd4140, ftLastAccessTime.dwHighDateTime=0x1d5b6d2, ftLastWriteTime.dwLowDateTime=0x55cd4140, ftLastWriteTime.dwHighDateTime=0x1d5b6d2, nFileSizeHigh=0x0, nFileSizeLow=0xf4a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="XErx7u1YawDfT4d.xlsx", cAlternateFileName="XERX7U~1.XLS")) returned 1 [0080.340] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0124330, ftCreationTime.dwHighDateTime=0x1d56c09, ftLastAccessTime.dwLowDateTime=0x4e92e4d0, ftLastAccessTime.dwHighDateTime=0x1d59c64, ftLastWriteTime.dwLowDateTime=0x4e92e4d0, ftLastWriteTime.dwHighDateTime=0x1d59c64, nFileSizeHigh=0x0, nFileSizeLow=0x819b, dwReserved0=0x0, dwReserved1=0x0, cFileName="yEsc.pptx", cAlternateFileName="YESC~1.PPT")) returned 1 [0080.340] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0124330, ftCreationTime.dwHighDateTime=0x1d56c09, ftLastAccessTime.dwLowDateTime=0x4e92e4d0, ftLastAccessTime.dwHighDateTime=0x1d59c64, ftLastWriteTime.dwLowDateTime=0x4e92e4d0, ftLastWriteTime.dwHighDateTime=0x1d59c64, nFileSizeHigh=0x0, nFileSizeLow=0x819b, dwReserved0=0x0, dwReserved1=0x0, cFileName="yEsc.pptx", cAlternateFileName="YESC~1.PPT")) returned 0 [0080.340] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0080.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf0c0) returned 1 [0080.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf0cc) returned 1 [0080.340] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\.", nBufferLength=0x105, lpBuffer=0x5bbebc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P", lpFilePart=0x0) returned 0x37 [0080.340] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P", nBufferLength=0x105, lpBuffer=0x5bbebf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P", lpFilePart=0x0) returned 0x37 [0080.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf050) returned 1 [0080.340] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\b80m5n3tef4nk1p"), fInfoLevelId=0x0, lpFileInformation=0x5bbf0cc | out: lpFileInformation=0x5bbf0cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddba0680, ftCreationTime.dwHighDateTime=0x1d5e3cb, ftLastAccessTime.dwLowDateTime=0xe835b1c0, ftLastAccessTime.dwHighDateTime=0x1d5e1de, ftLastWriteTime.dwLowDateTime=0xe835b1c0, ftLastWriteTime.dwHighDateTime=0x1d5e1de, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0080.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf04c) returned 1 [0080.341] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P", nBufferLength=0x105, lpBuffer=0x5bbebf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P", lpFilePart=0x0) returned 0x37 [0080.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf0bc) returned 1 [0080.341] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P", nBufferLength=0x105, lpBuffer=0x5bbebc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P", lpFilePart=0x0) returned 0x37 [0080.341] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\", nBufferLength=0x105, lpBuffer=0x5bbeb98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\", lpFilePart=0x0) returned 0x38 [0080.341] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\*", lpFindFileData=0x5bbede4 | out: lpFindFileData=0x5bbede4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddba0680, ftCreationTime.dwHighDateTime=0x1d5e3cb, ftLastAccessTime.dwLowDateTime=0xe835b1c0, ftLastAccessTime.dwHighDateTime=0x1d5e1de, ftLastWriteTime.dwLowDateTime=0xe835b1c0, ftLastWriteTime.dwHighDateTime=0x1d5e1de, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0080.341] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddba0680, ftCreationTime.dwHighDateTime=0x1d5e3cb, ftLastAccessTime.dwLowDateTime=0xe835b1c0, ftLastAccessTime.dwHighDateTime=0x1d5e1de, ftLastWriteTime.dwLowDateTime=0xe835b1c0, ftLastWriteTime.dwHighDateTime=0x1d5e1de, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.342] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bac0e0, ftCreationTime.dwHighDateTime=0x1d5e33a, ftLastAccessTime.dwLowDateTime=0x199c9d90, ftLastAccessTime.dwHighDateTime=0x1d5da79, ftLastWriteTime.dwLowDateTime=0x199c9d90, ftLastWriteTime.dwHighDateTime=0x1d5da79, nFileSizeHigh=0x0, nFileSizeLow=0x16ff3, dwReserved0=0x0, dwReserved1=0x0, cFileName="8oXu73Kth0ycR3.doc", cAlternateFileName="8OXU73~1.DOC")) returned 1 [0080.342] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a18c970, ftCreationTime.dwHighDateTime=0x1d5d892, ftLastAccessTime.dwLowDateTime=0x76de7c40, ftLastAccessTime.dwHighDateTime=0x1d5e7ca, ftLastWriteTime.dwLowDateTime=0x76de7c40, ftLastWriteTime.dwHighDateTime=0x1d5e7ca, nFileSizeHigh=0x0, nFileSizeLow=0xe6a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="fAtQEuC0.rtf", cAlternateFileName="")) returned 1 [0080.342] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef27a010, ftCreationTime.dwHighDateTime=0x1d5dc7a, ftLastAccessTime.dwLowDateTime=0x3bc337c0, ftLastAccessTime.dwHighDateTime=0x1d5d8fe, ftLastWriteTime.dwLowDateTime=0x3bc337c0, ftLastWriteTime.dwHighDateTime=0x1d5d8fe, nFileSizeHigh=0x0, nFileSizeLow=0x9699, dwReserved0=0x0, dwReserved1=0x0, cFileName="hrDgUoi27hBFkO.ots", cAlternateFileName="HRDGUO~1.OTS")) returned 1 [0080.342] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36194ae0, ftCreationTime.dwHighDateTime=0x1d5e325, ftLastAccessTime.dwLowDateTime=0xd376be90, ftLastAccessTime.dwHighDateTime=0x1d5df50, ftLastWriteTime.dwLowDateTime=0xd376be90, ftLastWriteTime.dwHighDateTime=0x1d5df50, nFileSizeHigh=0x0, nFileSizeLow=0x138d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ixvgGUCVkOM.ods", cAlternateFileName="IXVGGU~1.ODS")) returned 1 [0080.342] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc16e4380, ftCreationTime.dwHighDateTime=0x1d5d8ca, ftLastAccessTime.dwLowDateTime=0xf4e3bc0, ftLastAccessTime.dwHighDateTime=0x1d5e328, ftLastWriteTime.dwLowDateTime=0xf4e3bc0, ftLastWriteTime.dwHighDateTime=0x1d5e328, nFileSizeHigh=0x0, nFileSizeLow=0x1848f, dwReserved0=0x0, dwReserved1=0x0, cFileName="M1e0.ods", cAlternateFileName="")) returned 1 [0080.342] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfda5340, ftCreationTime.dwHighDateTime=0x1d5dbce, ftLastAccessTime.dwLowDateTime=0xf05d1d20, ftLastAccessTime.dwHighDateTime=0x1d5daa9, ftLastWriteTime.dwLowDateTime=0xf05d1d20, ftLastWriteTime.dwHighDateTime=0x1d5daa9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MFZvfNuU_GBRKp", cAlternateFileName="MFZVFN~1")) returned 1 [0080.343] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa44ddf10, ftCreationTime.dwHighDateTime=0x1d5e6ba, ftLastAccessTime.dwLowDateTime=0xea02cde0, ftLastAccessTime.dwHighDateTime=0x1d5deef, ftLastWriteTime.dwLowDateTime=0xea02cde0, ftLastWriteTime.dwHighDateTime=0x1d5deef, nFileSizeHigh=0x0, nFileSizeLow=0x946a, dwReserved0=0x0, dwReserved1=0x0, cFileName="oH_h085FyYS.ods", cAlternateFileName="OH_H08~1.ODS")) returned 1 [0080.343] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5931e340, ftCreationTime.dwHighDateTime=0x1d5e5e9, ftLastAccessTime.dwLowDateTime=0x4c6876a0, ftLastAccessTime.dwHighDateTime=0x1d5d960, ftLastWriteTime.dwLowDateTime=0x4c6876a0, ftLastWriteTime.dwHighDateTime=0x1d5d960, nFileSizeHigh=0x0, nFileSizeLow=0x7f2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PoMJ61slKXzugCu.pdf", cAlternateFileName="POMJ61~1.PDF")) returned 1 [0080.343] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5931e340, ftCreationTime.dwHighDateTime=0x1d5e5e9, ftLastAccessTime.dwLowDateTime=0x4c6876a0, ftLastAccessTime.dwHighDateTime=0x1d5d960, ftLastWriteTime.dwLowDateTime=0x4c6876a0, ftLastWriteTime.dwHighDateTime=0x1d5d960, nFileSizeHigh=0x0, nFileSizeLow=0x7f2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PoMJ61slKXzugCu.pdf", cAlternateFileName="POMJ61~1.PDF")) returned 0 [0080.343] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0080.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf07c) returned 1 [0080.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf088) returned 1 [0080.343] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\MFZvfNuU_GBRKp\\.", nBufferLength=0x105, lpBuffer=0x5bbeb7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\MFZvfNuU_GBRKp", lpFilePart=0x0) returned 0x46 [0080.343] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\MFZvfNuU_GBRKp", nBufferLength=0x105, lpBuffer=0x5bbebb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\MFZvfNuU_GBRKp", lpFilePart=0x0) returned 0x46 [0080.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf00c) returned 1 [0080.344] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\MFZvfNuU_GBRKp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\b80m5n3tef4nk1p\\mfzvfnuu_gbrkp"), fInfoLevelId=0x0, lpFileInformation=0x5bbf088 | out: lpFileInformation=0x5bbf088*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfda5340, ftCreationTime.dwHighDateTime=0x1d5dbce, ftLastAccessTime.dwLowDateTime=0xf05d1d20, ftLastAccessTime.dwHighDateTime=0x1d5daa9, ftLastWriteTime.dwLowDateTime=0xf05d1d20, ftLastWriteTime.dwHighDateTime=0x1d5daa9, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0080.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf008) returned 1 [0080.344] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\MFZvfNuU_GBRKp", nBufferLength=0x105, lpBuffer=0x5bbebb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\MFZvfNuU_GBRKp", lpFilePart=0x0) returned 0x46 [0080.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf078) returned 1 [0080.344] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\MFZvfNuU_GBRKp", nBufferLength=0x105, lpBuffer=0x5bbeb80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\MFZvfNuU_GBRKp", lpFilePart=0x0) returned 0x46 [0080.344] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\MFZvfNuU_GBRKp\\", nBufferLength=0x105, lpBuffer=0x5bbeb54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\MFZvfNuU_GBRKp\\", lpFilePart=0x0) returned 0x47 [0080.344] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\MFZvfNuU_GBRKp\\*", lpFindFileData=0x5bbeda0 | out: lpFindFileData=0x5bbeda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfda5340, ftCreationTime.dwHighDateTime=0x1d5dbce, ftLastAccessTime.dwLowDateTime=0xf05d1d20, ftLastAccessTime.dwHighDateTime=0x1d5daa9, ftLastWriteTime.dwLowDateTime=0xf05d1d20, ftLastWriteTime.dwHighDateTime=0x1d5daa9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0080.345] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfda5340, ftCreationTime.dwHighDateTime=0x1d5dbce, ftLastAccessTime.dwLowDateTime=0xf05d1d20, ftLastAccessTime.dwHighDateTime=0x1d5daa9, ftLastWriteTime.dwLowDateTime=0xf05d1d20, ftLastWriteTime.dwHighDateTime=0x1d5daa9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.345] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf19f3680, ftCreationTime.dwHighDateTime=0x1d5df3d, ftLastAccessTime.dwLowDateTime=0x2747a330, ftLastAccessTime.dwHighDateTime=0x1d5e376, ftLastWriteTime.dwLowDateTime=0x2747a330, ftLastWriteTime.dwHighDateTime=0x1d5e376, nFileSizeHigh=0x0, nFileSizeLow=0x147fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="3VqDm-xXTI_LmxRI56.ppt", cAlternateFileName="3VQDM-~1.PPT")) returned 1 [0080.345] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d380a70, ftCreationTime.dwHighDateTime=0x1d5e4a4, ftLastAccessTime.dwLowDateTime=0xde172990, ftLastAccessTime.dwHighDateTime=0x1d5da26, ftLastWriteTime.dwLowDateTime=0xde172990, ftLastWriteTime.dwHighDateTime=0x1d5da26, nFileSizeHigh=0x0, nFileSizeLow=0xef9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="9L1x9O6sfXTu5PeiPQx.pps", cAlternateFileName="9L1X9O~1.PPS")) returned 1 [0080.345] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9a30d40, ftCreationTime.dwHighDateTime=0x1d5e6fc, ftLastAccessTime.dwLowDateTime=0x21ebabe0, ftLastAccessTime.dwHighDateTime=0x1d5dc5d, ftLastWriteTime.dwLowDateTime=0x21ebabe0, ftLastWriteTime.dwHighDateTime=0x1d5dc5d, nFileSizeHigh=0x0, nFileSizeLow=0x17504, dwReserved0=0x0, dwReserved1=0x0, cFileName="dZatu8X5JR1Nz8GE6t.ppt", cAlternateFileName="DZATU8~1.PPT")) returned 1 [0080.345] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31327a80, ftCreationTime.dwHighDateTime=0x1d5e486, ftLastAccessTime.dwLowDateTime=0x71a0c0, ftLastAccessTime.dwHighDateTime=0x1d5e0ca, ftLastWriteTime.dwLowDateTime=0x71a0c0, ftLastWriteTime.dwHighDateTime=0x1d5e0ca, nFileSizeHigh=0x0, nFileSizeLow=0xed64, dwReserved0=0x0, dwReserved1=0x0, cFileName="OmhDj38iIAkVWQaFj0.xls", cAlternateFileName="OMHDJ3~1.XLS")) returned 1 [0080.345] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x503103a0, ftCreationTime.dwHighDateTime=0x1d5e0f0, ftLastAccessTime.dwLowDateTime=0x10030c50, ftLastAccessTime.dwHighDateTime=0x1d5dd13, ftLastWriteTime.dwLowDateTime=0x10030c50, ftLastWriteTime.dwHighDateTime=0x1d5dd13, nFileSizeHigh=0x0, nFileSizeLow=0x1713c, dwReserved0=0x0, dwReserved1=0x0, cFileName="RRhNxf iyLS.rtf", cAlternateFileName="RRHNXF~1.RTF")) returned 1 [0080.346] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x503103a0, ftCreationTime.dwHighDateTime=0x1d5e0f0, ftLastAccessTime.dwLowDateTime=0x10030c50, ftLastAccessTime.dwHighDateTime=0x1d5dd13, ftLastWriteTime.dwLowDateTime=0x10030c50, ftLastWriteTime.dwHighDateTime=0x1d5dd13, nFileSizeHigh=0x0, nFileSizeLow=0x1713c, dwReserved0=0x0, dwReserved1=0x0, cFileName="RRhNxf iyLS.rtf", cAlternateFileName="RRHNXF~1.RTF")) returned 0 [0080.346] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0080.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf038) returned 1 [0080.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf044) returned 1 [0080.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf078) returned 1 [0080.346] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\MFZvfNuU_GBRKp", nBufferLength=0x105, lpBuffer=0x5bbeb80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\MFZvfNuU_GBRKp", lpFilePart=0x0) returned 0x46 [0080.346] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\MFZvfNuU_GBRKp\\", nBufferLength=0x105, lpBuffer=0x5bbeb54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\MFZvfNuU_GBRKp\\", lpFilePart=0x0) returned 0x47 [0080.346] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\MFZvfNuU_GBRKp\\*", lpFindFileData=0x5bbeda0 | out: lpFindFileData=0x5bbeda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfda5340, ftCreationTime.dwHighDateTime=0x1d5dbce, ftLastAccessTime.dwLowDateTime=0xf05d1d20, ftLastAccessTime.dwHighDateTime=0x1d5daa9, ftLastWriteTime.dwLowDateTime=0xf05d1d20, ftLastWriteTime.dwHighDateTime=0x1d5daa9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0080.346] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfda5340, ftCreationTime.dwHighDateTime=0x1d5dbce, ftLastAccessTime.dwLowDateTime=0xf05d1d20, ftLastAccessTime.dwHighDateTime=0x1d5daa9, ftLastWriteTime.dwLowDateTime=0xf05d1d20, ftLastWriteTime.dwHighDateTime=0x1d5daa9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.347] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf19f3680, ftCreationTime.dwHighDateTime=0x1d5df3d, ftLastAccessTime.dwLowDateTime=0x2747a330, ftLastAccessTime.dwHighDateTime=0x1d5e376, ftLastWriteTime.dwLowDateTime=0x2747a330, ftLastWriteTime.dwHighDateTime=0x1d5e376, nFileSizeHigh=0x0, nFileSizeLow=0x147fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="3VqDm-xXTI_LmxRI56.ppt", cAlternateFileName="3VQDM-~1.PPT")) returned 1 [0080.347] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d380a70, ftCreationTime.dwHighDateTime=0x1d5e4a4, ftLastAccessTime.dwLowDateTime=0xde172990, ftLastAccessTime.dwHighDateTime=0x1d5da26, ftLastWriteTime.dwLowDateTime=0xde172990, ftLastWriteTime.dwHighDateTime=0x1d5da26, nFileSizeHigh=0x0, nFileSizeLow=0xef9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="9L1x9O6sfXTu5PeiPQx.pps", cAlternateFileName="9L1X9O~1.PPS")) returned 1 [0080.347] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9a30d40, ftCreationTime.dwHighDateTime=0x1d5e6fc, ftLastAccessTime.dwLowDateTime=0x21ebabe0, ftLastAccessTime.dwHighDateTime=0x1d5dc5d, ftLastWriteTime.dwLowDateTime=0x21ebabe0, ftLastWriteTime.dwHighDateTime=0x1d5dc5d, nFileSizeHigh=0x0, nFileSizeLow=0x17504, dwReserved0=0x0, dwReserved1=0x0, cFileName="dZatu8X5JR1Nz8GE6t.ppt", cAlternateFileName="DZATU8~1.PPT")) returned 1 [0080.347] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31327a80, ftCreationTime.dwHighDateTime=0x1d5e486, ftLastAccessTime.dwLowDateTime=0x71a0c0, ftLastAccessTime.dwHighDateTime=0x1d5e0ca, ftLastWriteTime.dwLowDateTime=0x71a0c0, ftLastWriteTime.dwHighDateTime=0x1d5e0ca, nFileSizeHigh=0x0, nFileSizeLow=0xed64, dwReserved0=0x0, dwReserved1=0x0, cFileName="OmhDj38iIAkVWQaFj0.xls", cAlternateFileName="OMHDJ3~1.XLS")) returned 1 [0080.347] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x503103a0, ftCreationTime.dwHighDateTime=0x1d5e0f0, ftLastAccessTime.dwLowDateTime=0x10030c50, ftLastAccessTime.dwHighDateTime=0x1d5dd13, ftLastWriteTime.dwLowDateTime=0x10030c50, ftLastWriteTime.dwHighDateTime=0x1d5dd13, nFileSizeHigh=0x0, nFileSizeLow=0x1713c, dwReserved0=0x0, dwReserved1=0x0, cFileName="RRhNxf iyLS.rtf", cAlternateFileName="RRHNXF~1.RTF")) returned 1 [0080.348] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0080.348] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0080.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf038) returned 1 [0080.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf044) returned 1 [0080.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf0bc) returned 1 [0080.348] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P", nBufferLength=0x105, lpBuffer=0x5bbebc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P", lpFilePart=0x0) returned 0x37 [0080.348] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\", nBufferLength=0x105, lpBuffer=0x5bbeb98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\", lpFilePart=0x0) returned 0x38 [0080.348] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\*", lpFindFileData=0x5bbede4 | out: lpFindFileData=0x5bbede4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddba0680, ftCreationTime.dwHighDateTime=0x1d5e3cb, ftLastAccessTime.dwLowDateTime=0xe835b1c0, ftLastAccessTime.dwHighDateTime=0x1d5e1de, ftLastWriteTime.dwLowDateTime=0xe835b1c0, ftLastWriteTime.dwHighDateTime=0x1d5e1de, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0080.349] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddba0680, ftCreationTime.dwHighDateTime=0x1d5e3cb, ftLastAccessTime.dwLowDateTime=0xe835b1c0, ftLastAccessTime.dwHighDateTime=0x1d5e1de, ftLastWriteTime.dwLowDateTime=0xe835b1c0, ftLastWriteTime.dwHighDateTime=0x1d5e1de, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.349] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bac0e0, ftCreationTime.dwHighDateTime=0x1d5e33a, ftLastAccessTime.dwLowDateTime=0x199c9d90, ftLastAccessTime.dwHighDateTime=0x1d5da79, ftLastWriteTime.dwLowDateTime=0x199c9d90, ftLastWriteTime.dwHighDateTime=0x1d5da79, nFileSizeHigh=0x0, nFileSizeLow=0x16ff3, dwReserved0=0x0, dwReserved1=0x0, cFileName="8oXu73Kth0ycR3.doc", cAlternateFileName="8OXU73~1.DOC")) returned 1 [0080.349] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a18c970, ftCreationTime.dwHighDateTime=0x1d5d892, ftLastAccessTime.dwLowDateTime=0x76de7c40, ftLastAccessTime.dwHighDateTime=0x1d5e7ca, ftLastWriteTime.dwLowDateTime=0x76de7c40, ftLastWriteTime.dwHighDateTime=0x1d5e7ca, nFileSizeHigh=0x0, nFileSizeLow=0xe6a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="fAtQEuC0.rtf", cAlternateFileName="")) returned 1 [0080.349] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef27a010, ftCreationTime.dwHighDateTime=0x1d5dc7a, ftLastAccessTime.dwLowDateTime=0x3bc337c0, ftLastAccessTime.dwHighDateTime=0x1d5d8fe, ftLastWriteTime.dwLowDateTime=0x3bc337c0, ftLastWriteTime.dwHighDateTime=0x1d5d8fe, nFileSizeHigh=0x0, nFileSizeLow=0x9699, dwReserved0=0x0, dwReserved1=0x0, cFileName="hrDgUoi27hBFkO.ots", cAlternateFileName="HRDGUO~1.OTS")) returned 1 [0080.349] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36194ae0, ftCreationTime.dwHighDateTime=0x1d5e325, ftLastAccessTime.dwLowDateTime=0xd376be90, ftLastAccessTime.dwHighDateTime=0x1d5df50, ftLastWriteTime.dwLowDateTime=0xd376be90, ftLastWriteTime.dwHighDateTime=0x1d5df50, nFileSizeHigh=0x0, nFileSizeLow=0x138d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ixvgGUCVkOM.ods", cAlternateFileName="IXVGGU~1.ODS")) returned 1 [0080.350] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc16e4380, ftCreationTime.dwHighDateTime=0x1d5d8ca, ftLastAccessTime.dwLowDateTime=0xf4e3bc0, ftLastAccessTime.dwHighDateTime=0x1d5e328, ftLastWriteTime.dwLowDateTime=0xf4e3bc0, ftLastWriteTime.dwHighDateTime=0x1d5e328, nFileSizeHigh=0x0, nFileSizeLow=0x1848f, dwReserved0=0x0, dwReserved1=0x0, cFileName="M1e0.ods", cAlternateFileName="")) returned 1 [0080.350] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfda5340, ftCreationTime.dwHighDateTime=0x1d5dbce, ftLastAccessTime.dwLowDateTime=0xf05d1d20, ftLastAccessTime.dwHighDateTime=0x1d5daa9, ftLastWriteTime.dwLowDateTime=0xf05d1d20, ftLastWriteTime.dwHighDateTime=0x1d5daa9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MFZvfNuU_GBRKp", cAlternateFileName="MFZVFN~1")) returned 1 [0080.350] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa44ddf10, ftCreationTime.dwHighDateTime=0x1d5e6ba, ftLastAccessTime.dwLowDateTime=0xea02cde0, ftLastAccessTime.dwHighDateTime=0x1d5deef, ftLastWriteTime.dwLowDateTime=0xea02cde0, ftLastWriteTime.dwHighDateTime=0x1d5deef, nFileSizeHigh=0x0, nFileSizeLow=0x946a, dwReserved0=0x0, dwReserved1=0x0, cFileName="oH_h085FyYS.ods", cAlternateFileName="OH_H08~1.ODS")) returned 1 [0080.350] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5931e340, ftCreationTime.dwHighDateTime=0x1d5e5e9, ftLastAccessTime.dwLowDateTime=0x4c6876a0, ftLastAccessTime.dwHighDateTime=0x1d5d960, ftLastWriteTime.dwLowDateTime=0x4c6876a0, ftLastWriteTime.dwHighDateTime=0x1d5d960, nFileSizeHigh=0x0, nFileSizeLow=0x7f2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PoMJ61slKXzugCu.pdf", cAlternateFileName="POMJ61~1.PDF")) returned 1 [0080.350] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0080.350] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0080.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf07c) returned 1 [0080.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf088) returned 1 [0080.351] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\.", nBufferLength=0x105, lpBuffer=0x5bbebc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music", lpFilePart=0x0) returned 0x30 [0080.351] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0x5bbebf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music", lpFilePart=0x0) returned 0x30 [0080.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf050) returned 1 [0080.351] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my music"), fInfoLevelId=0x0, lpFileInformation=0x5bbf0cc | out: lpFileInformation=0x5bbf0cc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0080.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf04c) returned 1 [0080.352] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0x5bbebf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music", lpFilePart=0x0) returned 0x30 [0080.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf0bc) returned 1 [0080.352] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0x5bbebc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music", lpFilePart=0x0) returned 0x30 [0080.352] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\", nBufferLength=0x105, lpBuffer=0x5bbeb98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\", lpFilePart=0x0) returned 0x31 [0080.352] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\*", lpFindFileData=0x5bbede4 | out: lpFindFileData=0x5bbede4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0080.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf080) returned 1 [0080.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf0bc) returned 1 [0080.593] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0x5bbebc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music", lpFilePart=0x0) returned 0x30 [0080.594] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\", nBufferLength=0x105, lpBuffer=0x5bbeb98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\", lpFilePart=0x0) returned 0x31 [0080.594] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\*", lpFindFileData=0x5bbede4 | out: lpFindFileData=0x5bbede4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0080.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf080) returned 1 [0080.596] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\.", nBufferLength=0x105, lpBuffer=0x5bbebc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures", lpFilePart=0x0) returned 0x33 [0080.596] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x5bbebf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures", lpFilePart=0x0) returned 0x33 [0080.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf050) returned 1 [0080.596] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my pictures"), fInfoLevelId=0x0, lpFileInformation=0x5bbf0cc | out: lpFileInformation=0x5bbf0cc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0080.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf04c) returned 1 [0080.597] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x5bbebf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures", lpFilePart=0x0) returned 0x33 [0080.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf0bc) returned 1 [0080.597] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x5bbebc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures", lpFilePart=0x0) returned 0x33 [0080.597] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\", nBufferLength=0x105, lpBuffer=0x5bbeb98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\", lpFilePart=0x0) returned 0x34 [0080.597] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\*", lpFindFileData=0x5bbede4 | out: lpFindFileData=0x5bbede4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0080.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf080) returned 1 [0080.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf0bc) returned 1 [0080.599] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x5bbebc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures", lpFilePart=0x0) returned 0x33 [0080.599] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\", nBufferLength=0x105, lpBuffer=0x5bbeb98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\", lpFilePart=0x0) returned 0x34 [0080.599] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\*", lpFindFileData=0x5bbede4 | out: lpFindFileData=0x5bbede4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0080.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf080) returned 1 [0080.601] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\.", nBufferLength=0x105, lpBuffer=0x5bbebc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes", lpFilePart=0x0) returned 0x31 [0080.601] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes", nBufferLength=0x105, lpBuffer=0x5bbebf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes", lpFilePart=0x0) returned 0x31 [0080.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf050) returned 1 [0080.602] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes"), fInfoLevelId=0x0, lpFileInformation=0x5bbf0cc | out: lpFileInformation=0x5bbf0cc*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0080.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf04c) returned 1 [0080.698] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes", nBufferLength=0x105, lpBuffer=0x5bbebf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes", lpFilePart=0x0) returned 0x31 [0080.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf0bc) returned 1 [0080.698] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes", nBufferLength=0x105, lpBuffer=0x5bbebc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes", lpFilePart=0x0) returned 0x31 [0080.698] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\", nBufferLength=0x105, lpBuffer=0x5bbeb98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\", lpFilePart=0x0) returned 0x32 [0080.698] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\*", lpFindFileData=0x5bbede4 | out: lpFindFileData=0x5bbede4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0080.698] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.698] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0080.699] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9e9e4460, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9e9e4460, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites.vss", cAlternateFileName="FAVORI~1.VSS")) returned 1 [0080.699] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1 [0080.699] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0080.699] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0080.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf07c) returned 1 [0080.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf088) returned 1 [0080.699] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\.", nBufferLength=0x105, lpBuffer=0x5bbeb7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private", lpFilePart=0x0) returned 0x3a [0080.699] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private", nBufferLength=0x105, lpBuffer=0x5bbebb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private", lpFilePart=0x0) returned 0x3a [0080.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf00c) returned 1 [0080.699] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private"), fInfoLevelId=0x0, lpFileInformation=0x5bbf088 | out: lpFileInformation=0x5bbf088*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0080.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf008) returned 1 [0080.740] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private", nBufferLength=0x105, lpBuffer=0x5bbebb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private", lpFilePart=0x0) returned 0x3a [0080.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf078) returned 1 [0080.740] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private", nBufferLength=0x105, lpBuffer=0x5bbeb80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private", lpFilePart=0x0) returned 0x3a [0080.741] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\", nBufferLength=0x105, lpBuffer=0x5bbeb54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\", lpFilePart=0x0) returned 0x3b [0080.741] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x5bbeda0 | out: lpFindFileData=0x5bbeda0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0080.741] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.741] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0080.741] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 0 [0080.742] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0080.742] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf038) returned 1 [0080.742] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf044) returned 1 [0080.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf078) returned 1 [0080.742] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private", nBufferLength=0x105, lpBuffer=0x5bbeb80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private", lpFilePart=0x0) returned 0x3a [0080.742] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\", nBufferLength=0x105, lpBuffer=0x5bbeb54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\", lpFilePart=0x0) returned 0x3b [0080.743] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x5bbeda0 | out: lpFindFileData=0x5bbeda0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0080.743] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.743] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0080.743] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0080.743] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0080.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf038) returned 1 [0080.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf044) returned 1 [0080.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf0bc) returned 1 [0080.744] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes", nBufferLength=0x105, lpBuffer=0x5bbebc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes", lpFilePart=0x0) returned 0x31 [0080.744] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\", nBufferLength=0x105, lpBuffer=0x5bbeb98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\", lpFilePart=0x0) returned 0x32 [0080.744] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\*", lpFindFileData=0x5bbede4 | out: lpFindFileData=0x5bbede4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0080.744] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.744] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0080.744] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9e9e4460, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9e9e4460, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites.vss", cAlternateFileName="FAVORI~1.VSS")) returned 1 [0080.745] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1 [0080.745] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 0 [0080.745] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0080.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf07c) returned 1 [0080.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf088) returned 1 [0080.745] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\.", nBufferLength=0x105, lpBuffer=0x5bbebc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos", lpFilePart=0x0) returned 0x31 [0080.745] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x5bbebf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos", lpFilePart=0x0) returned 0x31 [0080.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf050) returned 1 [0080.746] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my videos"), fInfoLevelId=0x0, lpFileInformation=0x5bbf0cc | out: lpFileInformation=0x5bbf0cc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0080.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf04c) returned 1 [0080.746] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x5bbebf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos", lpFilePart=0x0) returned 0x31 [0080.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf0bc) returned 1 [0080.746] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x5bbebc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos", lpFilePart=0x0) returned 0x31 [0080.746] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\", nBufferLength=0x105, lpBuffer=0x5bbeb98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\", lpFilePart=0x0) returned 0x32 [0080.746] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\*", lpFindFileData=0x5bbede4 | out: lpFindFileData=0x5bbede4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0080.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf080) returned 1 [0080.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf0bc) returned 1 [0080.748] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x5bbebc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos", lpFilePart=0x0) returned 0x31 [0080.748] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\", nBufferLength=0x105, lpBuffer=0x5bbeb98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\", lpFilePart=0x0) returned 0x32 [0080.749] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\*", lpFindFileData=0x5bbede4 | out: lpFindFileData=0x5bbede4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0080.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf080) returned 1 [0080.750] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\.", nBufferLength=0x105, lpBuffer=0x5bbebc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x35 [0080.750] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x5bbebf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x35 [0080.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf050) returned 1 [0080.751] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files"), fInfoLevelId=0x0, lpFileInformation=0x5bbf0cc | out: lpFileInformation=0x5bbf0cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8a4af3c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8a4af3c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0080.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf04c) returned 1 [0080.751] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x5bbebf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x35 [0080.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf0bc) returned 1 [0080.751] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x5bbebc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x35 [0080.751] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\", nBufferLength=0x105, lpBuffer=0x5bbeb98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\", lpFilePart=0x0) returned 0x36 [0080.751] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*", lpFindFileData=0x5bbede4 | out: lpFindFileData=0x5bbede4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8a4af3c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8a4af3c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0080.752] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8a4af3c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8a4af3c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.752] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x8a4fb680, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 1 [0080.752] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x8a4fb680, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 0 [0080.752] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0080.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf07c) returned 1 [0080.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf088) returned 1 [0080.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf0bc) returned 1 [0080.753] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x5bbebc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x35 [0080.753] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\", nBufferLength=0x105, lpBuffer=0x5bbeb98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\", lpFilePart=0x0) returned 0x36 [0080.753] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*", lpFindFileData=0x5bbede4 | out: lpFindFileData=0x5bbede4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8a4af3c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8a4af3c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0080.753] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8a4af3c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8a4af3c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.753] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x8a4fb680, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 1 [0080.753] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0080.753] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0080.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf07c) returned 1 [0080.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf088) returned 1 [0080.753] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\.", nBufferLength=0x105, lpBuffer=0x5bbebc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX", lpFilePart=0x0) returned 0x31 [0080.753] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX", nBufferLength=0x105, lpBuffer=0x5bbebf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX", lpFilePart=0x0) returned 0x31 [0080.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf050) returned 1 [0080.754] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ox2xe8wix"), fInfoLevelId=0x0, lpFileInformation=0x5bbf0cc | out: lpFileInformation=0x5bbf0cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedc3a100, ftCreationTime.dwHighDateTime=0x1d5dfa0, ftLastAccessTime.dwLowDateTime=0x63e311d0, ftLastAccessTime.dwHighDateTime=0x1d5db06, ftLastWriteTime.dwLowDateTime=0x63e311d0, ftLastWriteTime.dwHighDateTime=0x1d5db06, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0080.754] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf04c) returned 1 [0080.754] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX", nBufferLength=0x105, lpBuffer=0x5bbebf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX", lpFilePart=0x0) returned 0x31 [0080.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf0bc) returned 1 [0080.754] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX", nBufferLength=0x105, lpBuffer=0x5bbebc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX", lpFilePart=0x0) returned 0x31 [0080.754] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\", nBufferLength=0x105, lpBuffer=0x5bbeb98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\", lpFilePart=0x0) returned 0x32 [0080.754] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\*", lpFindFileData=0x5bbede4 | out: lpFindFileData=0x5bbede4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedc3a100, ftCreationTime.dwHighDateTime=0x1d5dfa0, ftLastAccessTime.dwLowDateTime=0x63e311d0, ftLastAccessTime.dwHighDateTime=0x1d5db06, ftLastWriteTime.dwLowDateTime=0x63e311d0, ftLastWriteTime.dwHighDateTime=0x1d5db06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0080.754] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedc3a100, ftCreationTime.dwHighDateTime=0x1d5dfa0, ftLastAccessTime.dwLowDateTime=0x63e311d0, ftLastAccessTime.dwHighDateTime=0x1d5db06, ftLastWriteTime.dwLowDateTime=0x63e311d0, ftLastWriteTime.dwHighDateTime=0x1d5db06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.755] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0121890, ftCreationTime.dwHighDateTime=0x1d5dec8, ftLastAccessTime.dwLowDateTime=0x92268860, ftLastAccessTime.dwHighDateTime=0x1d5e097, ftLastWriteTime.dwLowDateTime=0x92268860, ftLastWriteTime.dwHighDateTime=0x1d5e097, nFileSizeHigh=0x0, nFileSizeLow=0x70dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="eZ8F1rLnNZkF6PBD.pdf", cAlternateFileName="EZ8F1R~1.PDF")) returned 1 [0080.755] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb54e7250, ftCreationTime.dwHighDateTime=0x1d5e153, ftLastAccessTime.dwLowDateTime=0xf3912510, ftLastAccessTime.dwHighDateTime=0x1d5e0f6, ftLastWriteTime.dwLowDateTime=0xf3912510, ftLastWriteTime.dwHighDateTime=0x1d5e0f6, nFileSizeHigh=0x0, nFileSizeLow=0x2d32, dwReserved0=0x0, dwReserved1=0x0, cFileName="HbK2eYeZ0jl.ots", cAlternateFileName="HBK2EY~1.OTS")) returned 1 [0080.755] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18e8d910, ftCreationTime.dwHighDateTime=0x1d5db99, ftLastAccessTime.dwLowDateTime=0xca00b4c0, ftLastAccessTime.dwHighDateTime=0x1d5dc61, ftLastWriteTime.dwLowDateTime=0xca00b4c0, ftLastWriteTime.dwHighDateTime=0x1d5dc61, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kBB9 -d3qzol", cAlternateFileName="KBB9-D~1")) returned 1 [0080.755] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22768d40, ftCreationTime.dwHighDateTime=0x1d5dadd, ftLastAccessTime.dwLowDateTime=0x2d5e6da0, ftLastAccessTime.dwHighDateTime=0x1d5d889, ftLastWriteTime.dwLowDateTime=0x2d5e6da0, ftLastWriteTime.dwHighDateTime=0x1d5d889, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pofeVTrQS", cAlternateFileName="POFEVT~1")) returned 1 [0080.755] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7137b40, ftCreationTime.dwHighDateTime=0x1d5df7a, ftLastAccessTime.dwLowDateTime=0xf39a71e0, ftLastAccessTime.dwHighDateTime=0x1d5dc2a, ftLastWriteTime.dwLowDateTime=0xf39a71e0, ftLastWriteTime.dwHighDateTime=0x1d5dc2a, nFileSizeHigh=0x0, nFileSizeLow=0x18829, dwReserved0=0x0, dwReserved1=0x0, cFileName="u4Np4KbgMI.ots", cAlternateFileName="U4NP4K~1.OTS")) returned 1 [0080.755] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7137b40, ftCreationTime.dwHighDateTime=0x1d5df7a, ftLastAccessTime.dwLowDateTime=0xf39a71e0, ftLastAccessTime.dwHighDateTime=0x1d5dc2a, ftLastWriteTime.dwLowDateTime=0xf39a71e0, ftLastWriteTime.dwHighDateTime=0x1d5dc2a, nFileSizeHigh=0x0, nFileSizeLow=0x18829, dwReserved0=0x0, dwReserved1=0x0, cFileName="u4Np4KbgMI.ots", cAlternateFileName="U4NP4K~1.OTS")) returned 0 [0080.755] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0080.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf07c) returned 1 [0080.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf088) returned 1 [0080.756] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\kBB9 -d3qzol\\.", nBufferLength=0x105, lpBuffer=0x5bbeb7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\kBB9 -d3qzol", lpFilePart=0x0) returned 0x3e [0080.756] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\kBB9 -d3qzol", nBufferLength=0x105, lpBuffer=0x5bbebb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\kBB9 -d3qzol", lpFilePart=0x0) returned 0x3e [0080.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf00c) returned 1 [0080.756] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\kBB9 -d3qzol" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ox2xe8wix\\kbb9 -d3qzol"), fInfoLevelId=0x0, lpFileInformation=0x5bbf088 | out: lpFileInformation=0x5bbf088*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18e8d910, ftCreationTime.dwHighDateTime=0x1d5db99, ftLastAccessTime.dwLowDateTime=0xca00b4c0, ftLastAccessTime.dwHighDateTime=0x1d5dc61, ftLastWriteTime.dwLowDateTime=0xca00b4c0, ftLastWriteTime.dwHighDateTime=0x1d5dc61, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0080.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf008) returned 1 [0080.756] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\kBB9 -d3qzol", nBufferLength=0x105, lpBuffer=0x5bbebb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\kBB9 -d3qzol", lpFilePart=0x0) returned 0x3e [0080.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf078) returned 1 [0080.756] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\kBB9 -d3qzol", nBufferLength=0x105, lpBuffer=0x5bbeb80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\kBB9 -d3qzol", lpFilePart=0x0) returned 0x3e [0080.756] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\kBB9 -d3qzol\\", nBufferLength=0x105, lpBuffer=0x5bbeb54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\kBB9 -d3qzol\\", lpFilePart=0x0) returned 0x3f [0080.756] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\kBB9 -d3qzol\\*", lpFindFileData=0x5bbeda0 | out: lpFindFileData=0x5bbeda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18e8d910, ftCreationTime.dwHighDateTime=0x1d5db99, ftLastAccessTime.dwLowDateTime=0xca00b4c0, ftLastAccessTime.dwHighDateTime=0x1d5dc61, ftLastWriteTime.dwLowDateTime=0xca00b4c0, ftLastWriteTime.dwHighDateTime=0x1d5dc61, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0080.757] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18e8d910, ftCreationTime.dwHighDateTime=0x1d5db99, ftLastAccessTime.dwLowDateTime=0xca00b4c0, ftLastAccessTime.dwHighDateTime=0x1d5dc61, ftLastWriteTime.dwLowDateTime=0xca00b4c0, ftLastWriteTime.dwHighDateTime=0x1d5dc61, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.757] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3443440, ftCreationTime.dwHighDateTime=0x1d5dd17, ftLastAccessTime.dwLowDateTime=0x576db870, ftLastAccessTime.dwHighDateTime=0x1d5e1e0, ftLastWriteTime.dwLowDateTime=0x576db870, ftLastWriteTime.dwHighDateTime=0x1d5e1e0, nFileSizeHigh=0x0, nFileSizeLow=0x50b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="8-4fw.odp", cAlternateFileName="")) returned 1 [0080.757] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa71ba0a0, ftCreationTime.dwHighDateTime=0x1d5e00d, ftLastAccessTime.dwLowDateTime=0xab5fecd0, ftLastAccessTime.dwHighDateTime=0x1d5e66a, ftLastWriteTime.dwLowDateTime=0xab5fecd0, ftLastWriteTime.dwHighDateTime=0x1d5e66a, nFileSizeHigh=0x0, nFileSizeLow=0x9e7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="8by49RPV-VLLM6I8G6l.pps", cAlternateFileName="8BY49R~1.PPS")) returned 1 [0080.757] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa71ba0a0, ftCreationTime.dwHighDateTime=0x1d5e00d, ftLastAccessTime.dwLowDateTime=0xab5fecd0, ftLastAccessTime.dwHighDateTime=0x1d5e66a, ftLastWriteTime.dwLowDateTime=0xab5fecd0, ftLastWriteTime.dwHighDateTime=0x1d5e66a, nFileSizeHigh=0x0, nFileSizeLow=0x9e7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="8by49RPV-VLLM6I8G6l.pps", cAlternateFileName="8BY49R~1.PPS")) returned 0 [0080.757] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0080.757] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf038) returned 1 [0080.757] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf044) returned 1 [0080.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf078) returned 1 [0080.757] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\kBB9 -d3qzol", nBufferLength=0x105, lpBuffer=0x5bbeb80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\kBB9 -d3qzol", lpFilePart=0x0) returned 0x3e [0080.757] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\kBB9 -d3qzol\\", nBufferLength=0x105, lpBuffer=0x5bbeb54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\kBB9 -d3qzol\\", lpFilePart=0x0) returned 0x3f [0080.758] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\kBB9 -d3qzol\\*", lpFindFileData=0x5bbeda0 | out: lpFindFileData=0x5bbeda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18e8d910, ftCreationTime.dwHighDateTime=0x1d5db99, ftLastAccessTime.dwLowDateTime=0xca00b4c0, ftLastAccessTime.dwHighDateTime=0x1d5dc61, ftLastWriteTime.dwLowDateTime=0xca00b4c0, ftLastWriteTime.dwHighDateTime=0x1d5dc61, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0080.758] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18e8d910, ftCreationTime.dwHighDateTime=0x1d5db99, ftLastAccessTime.dwLowDateTime=0xca00b4c0, ftLastAccessTime.dwHighDateTime=0x1d5dc61, ftLastWriteTime.dwLowDateTime=0xca00b4c0, ftLastWriteTime.dwHighDateTime=0x1d5dc61, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.758] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3443440, ftCreationTime.dwHighDateTime=0x1d5dd17, ftLastAccessTime.dwLowDateTime=0x576db870, ftLastAccessTime.dwHighDateTime=0x1d5e1e0, ftLastWriteTime.dwLowDateTime=0x576db870, ftLastWriteTime.dwHighDateTime=0x1d5e1e0, nFileSizeHigh=0x0, nFileSizeLow=0x50b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="8-4fw.odp", cAlternateFileName="")) returned 1 [0080.758] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa71ba0a0, ftCreationTime.dwHighDateTime=0x1d5e00d, ftLastAccessTime.dwLowDateTime=0xab5fecd0, ftLastAccessTime.dwHighDateTime=0x1d5e66a, ftLastWriteTime.dwLowDateTime=0xab5fecd0, ftLastWriteTime.dwHighDateTime=0x1d5e66a, nFileSizeHigh=0x0, nFileSizeLow=0x9e7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="8by49RPV-VLLM6I8G6l.pps", cAlternateFileName="8BY49R~1.PPS")) returned 1 [0080.758] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0080.758] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0080.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf038) returned 1 [0080.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf044) returned 1 [0080.758] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\pofeVTrQS\\.", nBufferLength=0x105, lpBuffer=0x5bbeb7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\pofeVTrQS", lpFilePart=0x0) returned 0x3b [0080.759] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\pofeVTrQS", nBufferLength=0x105, lpBuffer=0x5bbebb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\pofeVTrQS", lpFilePart=0x0) returned 0x3b [0080.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf00c) returned 1 [0080.759] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\pofeVTrQS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ox2xe8wix\\pofevtrqs"), fInfoLevelId=0x0, lpFileInformation=0x5bbf088 | out: lpFileInformation=0x5bbf088*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22768d40, ftCreationTime.dwHighDateTime=0x1d5dadd, ftLastAccessTime.dwLowDateTime=0x2d5e6da0, ftLastAccessTime.dwHighDateTime=0x1d5d889, ftLastWriteTime.dwLowDateTime=0x2d5e6da0, ftLastWriteTime.dwHighDateTime=0x1d5d889, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0080.759] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf008) returned 1 [0080.759] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\pofeVTrQS", nBufferLength=0x105, lpBuffer=0x5bbebb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\pofeVTrQS", lpFilePart=0x0) returned 0x3b [0080.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf078) returned 1 [0080.759] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\pofeVTrQS", nBufferLength=0x105, lpBuffer=0x5bbeb80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\pofeVTrQS", lpFilePart=0x0) returned 0x3b [0080.759] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\pofeVTrQS\\", nBufferLength=0x105, lpBuffer=0x5bbeb54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\pofeVTrQS\\", lpFilePart=0x0) returned 0x3c [0080.759] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\pofeVTrQS\\*", lpFindFileData=0x5bbeda0 | out: lpFindFileData=0x5bbeda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22768d40, ftCreationTime.dwHighDateTime=0x1d5dadd, ftLastAccessTime.dwLowDateTime=0x2d5e6da0, ftLastAccessTime.dwHighDateTime=0x1d5d889, ftLastWriteTime.dwLowDateTime=0x2d5e6da0, ftLastWriteTime.dwHighDateTime=0x1d5d889, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0080.760] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22768d40, ftCreationTime.dwHighDateTime=0x1d5dadd, ftLastAccessTime.dwLowDateTime=0x2d5e6da0, ftLastAccessTime.dwHighDateTime=0x1d5d889, ftLastWriteTime.dwLowDateTime=0x2d5e6da0, ftLastWriteTime.dwHighDateTime=0x1d5d889, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.760] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54d38040, ftCreationTime.dwHighDateTime=0x1d5dc27, ftLastAccessTime.dwLowDateTime=0x4822c530, ftLastAccessTime.dwHighDateTime=0x1d5e56a, ftLastWriteTime.dwLowDateTime=0x4822c530, ftLastWriteTime.dwHighDateTime=0x1d5e56a, nFileSizeHigh=0x0, nFileSizeLow=0x9314, dwReserved0=0x0, dwReserved1=0x0, cFileName="jA5n3bQ y.odt", cAlternateFileName="JA5N3B~1.ODT")) returned 1 [0080.760] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae07450, ftCreationTime.dwHighDateTime=0x1d5e47b, ftLastAccessTime.dwLowDateTime=0x5e6d6cd0, ftLastAccessTime.dwHighDateTime=0x1d5e558, ftLastWriteTime.dwLowDateTime=0x5e6d6cd0, ftLastWriteTime.dwHighDateTime=0x1d5e558, nFileSizeHigh=0x0, nFileSizeLow=0x5c64, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZtGNUjd.rtf", cAlternateFileName="")) returned 1 [0080.761] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae07450, ftCreationTime.dwHighDateTime=0x1d5e47b, ftLastAccessTime.dwLowDateTime=0x5e6d6cd0, ftLastAccessTime.dwHighDateTime=0x1d5e558, ftLastWriteTime.dwLowDateTime=0x5e6d6cd0, ftLastWriteTime.dwHighDateTime=0x1d5e558, nFileSizeHigh=0x0, nFileSizeLow=0x5c64, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZtGNUjd.rtf", cAlternateFileName="")) returned 0 [0080.761] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0080.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf038) returned 1 [0080.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf044) returned 1 [0080.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf078) returned 1 [0080.761] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\pofeVTrQS", nBufferLength=0x105, lpBuffer=0x5bbeb80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\pofeVTrQS", lpFilePart=0x0) returned 0x3b [0080.808] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\pofeVTrQS\\", nBufferLength=0x105, lpBuffer=0x5bbeb54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\pofeVTrQS\\", lpFilePart=0x0) returned 0x3c [0080.809] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\pofeVTrQS\\*", lpFindFileData=0x5bbeda0 | out: lpFindFileData=0x5bbeda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22768d40, ftCreationTime.dwHighDateTime=0x1d5dadd, ftLastAccessTime.dwLowDateTime=0x2d5e6da0, ftLastAccessTime.dwHighDateTime=0x1d5d889, ftLastWriteTime.dwLowDateTime=0x2d5e6da0, ftLastWriteTime.dwHighDateTime=0x1d5d889, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0080.809] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22768d40, ftCreationTime.dwHighDateTime=0x1d5dadd, ftLastAccessTime.dwLowDateTime=0x2d5e6da0, ftLastAccessTime.dwHighDateTime=0x1d5d889, ftLastWriteTime.dwLowDateTime=0x2d5e6da0, ftLastWriteTime.dwHighDateTime=0x1d5d889, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.809] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54d38040, ftCreationTime.dwHighDateTime=0x1d5dc27, ftLastAccessTime.dwLowDateTime=0x4822c530, ftLastAccessTime.dwHighDateTime=0x1d5e56a, ftLastWriteTime.dwLowDateTime=0x4822c530, ftLastWriteTime.dwHighDateTime=0x1d5e56a, nFileSizeHigh=0x0, nFileSizeLow=0x9314, dwReserved0=0x0, dwReserved1=0x0, cFileName="jA5n3bQ y.odt", cAlternateFileName="JA5N3B~1.ODT")) returned 1 [0080.809] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae07450, ftCreationTime.dwHighDateTime=0x1d5e47b, ftLastAccessTime.dwLowDateTime=0x5e6d6cd0, ftLastAccessTime.dwHighDateTime=0x1d5e558, ftLastWriteTime.dwLowDateTime=0x5e6d6cd0, ftLastWriteTime.dwHighDateTime=0x1d5e558, nFileSizeHigh=0x0, nFileSizeLow=0x5c64, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZtGNUjd.rtf", cAlternateFileName="")) returned 1 [0080.809] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0080.810] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0080.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf038) returned 1 [0080.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf044) returned 1 [0080.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf0bc) returned 1 [0080.810] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX", nBufferLength=0x105, lpBuffer=0x5bbebc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX", lpFilePart=0x0) returned 0x31 [0080.810] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\", nBufferLength=0x105, lpBuffer=0x5bbeb98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\", lpFilePart=0x0) returned 0x32 [0080.810] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\*", lpFindFileData=0x5bbede4 | out: lpFindFileData=0x5bbede4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedc3a100, ftCreationTime.dwHighDateTime=0x1d5dfa0, ftLastAccessTime.dwLowDateTime=0x63e311d0, ftLastAccessTime.dwHighDateTime=0x1d5db06, ftLastWriteTime.dwLowDateTime=0x63e311d0, ftLastWriteTime.dwHighDateTime=0x1d5db06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0080.810] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedc3a100, ftCreationTime.dwHighDateTime=0x1d5dfa0, ftLastAccessTime.dwLowDateTime=0x63e311d0, ftLastAccessTime.dwHighDateTime=0x1d5db06, ftLastWriteTime.dwLowDateTime=0x63e311d0, ftLastWriteTime.dwHighDateTime=0x1d5db06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.811] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0121890, ftCreationTime.dwHighDateTime=0x1d5dec8, ftLastAccessTime.dwLowDateTime=0x92268860, ftLastAccessTime.dwHighDateTime=0x1d5e097, ftLastWriteTime.dwLowDateTime=0x92268860, ftLastWriteTime.dwHighDateTime=0x1d5e097, nFileSizeHigh=0x0, nFileSizeLow=0x70dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="eZ8F1rLnNZkF6PBD.pdf", cAlternateFileName="EZ8F1R~1.PDF")) returned 1 [0080.811] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb54e7250, ftCreationTime.dwHighDateTime=0x1d5e153, ftLastAccessTime.dwLowDateTime=0xf3912510, ftLastAccessTime.dwHighDateTime=0x1d5e0f6, ftLastWriteTime.dwLowDateTime=0xf3912510, ftLastWriteTime.dwHighDateTime=0x1d5e0f6, nFileSizeHigh=0x0, nFileSizeLow=0x2d32, dwReserved0=0x0, dwReserved1=0x0, cFileName="HbK2eYeZ0jl.ots", cAlternateFileName="HBK2EY~1.OTS")) returned 1 [0080.811] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18e8d910, ftCreationTime.dwHighDateTime=0x1d5db99, ftLastAccessTime.dwLowDateTime=0xca00b4c0, ftLastAccessTime.dwHighDateTime=0x1d5dc61, ftLastWriteTime.dwLowDateTime=0xca00b4c0, ftLastWriteTime.dwHighDateTime=0x1d5dc61, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kBB9 -d3qzol", cAlternateFileName="KBB9-D~1")) returned 1 [0080.811] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22768d40, ftCreationTime.dwHighDateTime=0x1d5dadd, ftLastAccessTime.dwLowDateTime=0x2d5e6da0, ftLastAccessTime.dwHighDateTime=0x1d5d889, ftLastWriteTime.dwLowDateTime=0x2d5e6da0, ftLastWriteTime.dwHighDateTime=0x1d5d889, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pofeVTrQS", cAlternateFileName="POFEVT~1")) returned 1 [0080.811] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7137b40, ftCreationTime.dwHighDateTime=0x1d5df7a, ftLastAccessTime.dwLowDateTime=0xf39a71e0, ftLastAccessTime.dwHighDateTime=0x1d5dc2a, ftLastWriteTime.dwLowDateTime=0xf39a71e0, ftLastWriteTime.dwHighDateTime=0x1d5dc2a, nFileSizeHigh=0x0, nFileSizeLow=0x18829, dwReserved0=0x0, dwReserved1=0x0, cFileName="u4Np4KbgMI.ots", cAlternateFileName="U4NP4K~1.OTS")) returned 1 [0080.811] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0080.811] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0080.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf07c) returned 1 [0080.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf088) returned 1 [0080.812] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QmUng5_ZXRVu\\.", nBufferLength=0x105, lpBuffer=0x5bbebc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QmUng5_ZXRVu", lpFilePart=0x0) returned 0x34 [0080.812] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QmUng5_ZXRVu", nBufferLength=0x105, lpBuffer=0x5bbebf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QmUng5_ZXRVu", lpFilePart=0x0) returned 0x34 [0080.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf050) returned 1 [0080.812] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QmUng5_ZXRVu" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qmung5_zxrvu"), fInfoLevelId=0x0, lpFileInformation=0x5bbf0cc | out: lpFileInformation=0x5bbf0cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a2ea540, ftCreationTime.dwHighDateTime=0x1d5da48, ftLastAccessTime.dwLowDateTime=0x52cdcad0, ftLastAccessTime.dwHighDateTime=0x1d5db9b, ftLastWriteTime.dwLowDateTime=0x52cdcad0, ftLastWriteTime.dwHighDateTime=0x1d5db9b, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0080.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf04c) returned 1 [0080.812] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QmUng5_ZXRVu", nBufferLength=0x105, lpBuffer=0x5bbebf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QmUng5_ZXRVu", lpFilePart=0x0) returned 0x34 [0080.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf0bc) returned 1 [0080.812] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QmUng5_ZXRVu", nBufferLength=0x105, lpBuffer=0x5bbebc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QmUng5_ZXRVu", lpFilePart=0x0) returned 0x34 [0080.812] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QmUng5_ZXRVu\\", nBufferLength=0x105, lpBuffer=0x5bbeb98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QmUng5_ZXRVu\\", lpFilePart=0x0) returned 0x35 [0080.812] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QmUng5_ZXRVu\\*", lpFindFileData=0x5bbede4 | out: lpFindFileData=0x5bbede4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a2ea540, ftCreationTime.dwHighDateTime=0x1d5da48, ftLastAccessTime.dwLowDateTime=0x52cdcad0, ftLastAccessTime.dwHighDateTime=0x1d5db9b, ftLastWriteTime.dwLowDateTime=0x52cdcad0, ftLastWriteTime.dwHighDateTime=0x1d5db9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0080.813] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a2ea540, ftCreationTime.dwHighDateTime=0x1d5da48, ftLastAccessTime.dwLowDateTime=0x52cdcad0, ftLastAccessTime.dwHighDateTime=0x1d5db9b, ftLastWriteTime.dwLowDateTime=0x52cdcad0, ftLastWriteTime.dwHighDateTime=0x1d5db9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.813] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b9c21e0, ftCreationTime.dwHighDateTime=0x1d5dd84, ftLastAccessTime.dwLowDateTime=0x30e66b40, ftLastAccessTime.dwHighDateTime=0x1d5e1f2, ftLastWriteTime.dwLowDateTime=0x30e66b40, ftLastWriteTime.dwHighDateTime=0x1d5e1f2, nFileSizeHigh=0x0, nFileSizeLow=0x144df, dwReserved0=0x0, dwReserved1=0x0, cFileName="eLG g.csv", cAlternateFileName="ELGG~1.CSV")) returned 1 [0080.813] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9c986e0, ftCreationTime.dwHighDateTime=0x1d5da11, ftLastAccessTime.dwLowDateTime=0xbd824a50, ftLastAccessTime.dwHighDateTime=0x1d5d9dd, ftLastWriteTime.dwLowDateTime=0xbd824a50, ftLastWriteTime.dwHighDateTime=0x1d5d9dd, nFileSizeHigh=0x0, nFileSizeLow=0xc432, dwReserved0=0x0, dwReserved1=0x0, cFileName="JbAihv8NrCGcTNBQ.docx", cAlternateFileName="JBAIHV~1.DOC")) returned 1 [0080.813] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c0474e0, ftCreationTime.dwHighDateTime=0x1d5e3d2, ftLastAccessTime.dwLowDateTime=0x4993de30, ftLastAccessTime.dwHighDateTime=0x1d5e2f5, ftLastWriteTime.dwLowDateTime=0x4993de30, ftLastWriteTime.dwHighDateTime=0x1d5e2f5, nFileSizeHigh=0x0, nFileSizeLow=0x148b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Jg4DO.odp", cAlternateFileName="")) returned 1 [0080.813] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd998f50, ftCreationTime.dwHighDateTime=0x1d5db03, ftLastAccessTime.dwLowDateTime=0xbe377500, ftLastAccessTime.dwHighDateTime=0x1d5e1ea, ftLastWriteTime.dwLowDateTime=0xbe377500, ftLastWriteTime.dwHighDateTime=0x1d5e1ea, nFileSizeHigh=0x0, nFileSizeLow=0x13661, dwReserved0=0x0, dwReserved1=0x0, cFileName="puw07N7wzlsssBxsxS6.odp", cAlternateFileName="PUW07N~1.ODP")) returned 1 [0080.813] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d5527b0, ftCreationTime.dwHighDateTime=0x1d5e60a, ftLastAccessTime.dwLowDateTime=0x5df22e10, ftLastAccessTime.dwHighDateTime=0x1d5e573, ftLastWriteTime.dwLowDateTime=0x5df22e10, ftLastWriteTime.dwHighDateTime=0x1d5e573, nFileSizeHigh=0x0, nFileSizeLow=0x1c28, dwReserved0=0x0, dwReserved1=0x0, cFileName="QX1JIeX776Md8_Ud3.odp", cAlternateFileName="QX1JIE~1.ODP")) returned 1 [0080.814] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70615930, ftCreationTime.dwHighDateTime=0x1d5dfcf, ftLastAccessTime.dwLowDateTime=0xedbb2b80, ftLastAccessTime.dwHighDateTime=0x1d5e390, ftLastWriteTime.dwLowDateTime=0xedbb2b80, ftLastWriteTime.dwHighDateTime=0x1d5e390, nFileSizeHigh=0x0, nFileSizeLow=0x1305f, dwReserved0=0x0, dwReserved1=0x0, cFileName="r5AONVBn.csv", cAlternateFileName="")) returned 1 [0080.814] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd203a7f0, ftCreationTime.dwHighDateTime=0x1d5e6e2, ftLastAccessTime.dwLowDateTime=0x4fee38a0, ftLastAccessTime.dwHighDateTime=0x1d5dbea, ftLastWriteTime.dwLowDateTime=0x4fee38a0, ftLastWriteTime.dwHighDateTime=0x1d5dbea, nFileSizeHigh=0x0, nFileSizeLow=0x170c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="ScSDD9lkRvZQeGQebi.ots", cAlternateFileName="SCSDD9~1.OTS")) returned 1 [0080.814] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac3bfe50, ftCreationTime.dwHighDateTime=0x1d5d7ab, ftLastAccessTime.dwLowDateTime=0x30b6b1d0, ftLastAccessTime.dwHighDateTime=0x1d5e007, ftLastWriteTime.dwLowDateTime=0x30b6b1d0, ftLastWriteTime.dwHighDateTime=0x1d5e007, nFileSizeHigh=0x0, nFileSizeLow=0x8ff6, dwReserved0=0x0, dwReserved1=0x0, cFileName="vTmvP4H8a3D.odt", cAlternateFileName="VTMVP4~1.ODT")) returned 1 [0080.814] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac3bfe50, ftCreationTime.dwHighDateTime=0x1d5d7ab, ftLastAccessTime.dwLowDateTime=0x30b6b1d0, ftLastAccessTime.dwHighDateTime=0x1d5e007, ftLastWriteTime.dwLowDateTime=0x30b6b1d0, ftLastWriteTime.dwHighDateTime=0x1d5e007, nFileSizeHigh=0x0, nFileSizeLow=0x8ff6, dwReserved0=0x0, dwReserved1=0x0, cFileName="vTmvP4H8a3D.odt", cAlternateFileName="VTMVP4~1.ODT")) returned 0 [0080.814] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0080.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf07c) returned 1 [0080.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf088) returned 1 [0080.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf0bc) returned 1 [0080.814] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QmUng5_ZXRVu", nBufferLength=0x105, lpBuffer=0x5bbebc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QmUng5_ZXRVu", lpFilePart=0x0) returned 0x34 [0080.815] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QmUng5_ZXRVu\\", nBufferLength=0x105, lpBuffer=0x5bbeb98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QmUng5_ZXRVu\\", lpFilePart=0x0) returned 0x35 [0080.815] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QmUng5_ZXRVu\\*", lpFindFileData=0x5bbede4 | out: lpFindFileData=0x5bbede4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a2ea540, ftCreationTime.dwHighDateTime=0x1d5da48, ftLastAccessTime.dwLowDateTime=0x52cdcad0, ftLastAccessTime.dwHighDateTime=0x1d5db9b, ftLastWriteTime.dwLowDateTime=0x52cdcad0, ftLastWriteTime.dwHighDateTime=0x1d5db9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0080.815] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a2ea540, ftCreationTime.dwHighDateTime=0x1d5da48, ftLastAccessTime.dwLowDateTime=0x52cdcad0, ftLastAccessTime.dwHighDateTime=0x1d5db9b, ftLastWriteTime.dwLowDateTime=0x52cdcad0, ftLastWriteTime.dwHighDateTime=0x1d5db9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.815] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b9c21e0, ftCreationTime.dwHighDateTime=0x1d5dd84, ftLastAccessTime.dwLowDateTime=0x30e66b40, ftLastAccessTime.dwHighDateTime=0x1d5e1f2, ftLastWriteTime.dwLowDateTime=0x30e66b40, ftLastWriteTime.dwHighDateTime=0x1d5e1f2, nFileSizeHigh=0x0, nFileSizeLow=0x144df, dwReserved0=0x0, dwReserved1=0x0, cFileName="eLG g.csv", cAlternateFileName="ELGG~1.CSV")) returned 1 [0080.815] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9c986e0, ftCreationTime.dwHighDateTime=0x1d5da11, ftLastAccessTime.dwLowDateTime=0xbd824a50, ftLastAccessTime.dwHighDateTime=0x1d5d9dd, ftLastWriteTime.dwLowDateTime=0xbd824a50, ftLastWriteTime.dwHighDateTime=0x1d5d9dd, nFileSizeHigh=0x0, nFileSizeLow=0xc432, dwReserved0=0x0, dwReserved1=0x0, cFileName="JbAihv8NrCGcTNBQ.docx", cAlternateFileName="JBAIHV~1.DOC")) returned 1 [0080.816] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c0474e0, ftCreationTime.dwHighDateTime=0x1d5e3d2, ftLastAccessTime.dwLowDateTime=0x4993de30, ftLastAccessTime.dwHighDateTime=0x1d5e2f5, ftLastWriteTime.dwLowDateTime=0x4993de30, ftLastWriteTime.dwHighDateTime=0x1d5e2f5, nFileSizeHigh=0x0, nFileSizeLow=0x148b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Jg4DO.odp", cAlternateFileName="")) returned 1 [0080.816] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd998f50, ftCreationTime.dwHighDateTime=0x1d5db03, ftLastAccessTime.dwLowDateTime=0xbe377500, ftLastAccessTime.dwHighDateTime=0x1d5e1ea, ftLastWriteTime.dwLowDateTime=0xbe377500, ftLastWriteTime.dwHighDateTime=0x1d5e1ea, nFileSizeHigh=0x0, nFileSizeLow=0x13661, dwReserved0=0x0, dwReserved1=0x0, cFileName="puw07N7wzlsssBxsxS6.odp", cAlternateFileName="PUW07N~1.ODP")) returned 1 [0080.816] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d5527b0, ftCreationTime.dwHighDateTime=0x1d5e60a, ftLastAccessTime.dwLowDateTime=0x5df22e10, ftLastAccessTime.dwHighDateTime=0x1d5e573, ftLastWriteTime.dwLowDateTime=0x5df22e10, ftLastWriteTime.dwHighDateTime=0x1d5e573, nFileSizeHigh=0x0, nFileSizeLow=0x1c28, dwReserved0=0x0, dwReserved1=0x0, cFileName="QX1JIeX776Md8_Ud3.odp", cAlternateFileName="QX1JIE~1.ODP")) returned 1 [0080.816] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70615930, ftCreationTime.dwHighDateTime=0x1d5dfcf, ftLastAccessTime.dwLowDateTime=0xedbb2b80, ftLastAccessTime.dwHighDateTime=0x1d5e390, ftLastWriteTime.dwLowDateTime=0xedbb2b80, ftLastWriteTime.dwHighDateTime=0x1d5e390, nFileSizeHigh=0x0, nFileSizeLow=0x1305f, dwReserved0=0x0, dwReserved1=0x0, cFileName="r5AONVBn.csv", cAlternateFileName="")) returned 1 [0080.816] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd203a7f0, ftCreationTime.dwHighDateTime=0x1d5e6e2, ftLastAccessTime.dwLowDateTime=0x4fee38a0, ftLastAccessTime.dwHighDateTime=0x1d5dbea, ftLastWriteTime.dwLowDateTime=0x4fee38a0, ftLastWriteTime.dwHighDateTime=0x1d5dbea, nFileSizeHigh=0x0, nFileSizeLow=0x170c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="ScSDD9lkRvZQeGQebi.ots", cAlternateFileName="SCSDD9~1.OTS")) returned 1 [0080.816] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac3bfe50, ftCreationTime.dwHighDateTime=0x1d5d7ab, ftLastAccessTime.dwLowDateTime=0x30b6b1d0, ftLastAccessTime.dwHighDateTime=0x1d5e007, ftLastWriteTime.dwLowDateTime=0x30b6b1d0, ftLastWriteTime.dwHighDateTime=0x1d5e007, nFileSizeHigh=0x0, nFileSizeLow=0x8ff6, dwReserved0=0x0, dwReserved1=0x0, cFileName="vTmvP4H8a3D.odt", cAlternateFileName="VTMVP4~1.ODT")) returned 1 [0080.816] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0080.816] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0080.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf07c) returned 1 [0080.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf088) returned 1 [0080.817] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rIREdumyZRX80jt2\\.", nBufferLength=0x105, lpBuffer=0x5bbebc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rIREdumyZRX80jt2", lpFilePart=0x0) returned 0x38 [0080.817] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rIREdumyZRX80jt2", nBufferLength=0x105, lpBuffer=0x5bbebf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rIREdumyZRX80jt2", lpFilePart=0x0) returned 0x38 [0080.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf050) returned 1 [0080.817] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rIREdumyZRX80jt2" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\riredumyzrx80jt2"), fInfoLevelId=0x0, lpFileInformation=0x5bbf0cc | out: lpFileInformation=0x5bbf0cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x827cc010, ftCreationTime.dwHighDateTime=0x1d5d95c, ftLastAccessTime.dwLowDateTime=0x2b1954f0, ftLastAccessTime.dwHighDateTime=0x1d5def2, ftLastWriteTime.dwLowDateTime=0x2b1954f0, ftLastWriteTime.dwHighDateTime=0x1d5def2, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0080.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf04c) returned 1 [0080.817] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rIREdumyZRX80jt2", nBufferLength=0x105, lpBuffer=0x5bbebf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rIREdumyZRX80jt2", lpFilePart=0x0) returned 0x38 [0080.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf0bc) returned 1 [0080.817] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rIREdumyZRX80jt2", nBufferLength=0x105, lpBuffer=0x5bbebc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rIREdumyZRX80jt2", lpFilePart=0x0) returned 0x38 [0080.817] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rIREdumyZRX80jt2\\", nBufferLength=0x105, lpBuffer=0x5bbeb98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rIREdumyZRX80jt2\\", lpFilePart=0x0) returned 0x39 [0080.817] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rIREdumyZRX80jt2\\*", lpFindFileData=0x5bbede4 | out: lpFindFileData=0x5bbede4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x827cc010, ftCreationTime.dwHighDateTime=0x1d5d95c, ftLastAccessTime.dwLowDateTime=0x2b1954f0, ftLastAccessTime.dwHighDateTime=0x1d5def2, ftLastWriteTime.dwLowDateTime=0x2b1954f0, ftLastWriteTime.dwHighDateTime=0x1d5def2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0080.818] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x827cc010, ftCreationTime.dwHighDateTime=0x1d5d95c, ftLastAccessTime.dwLowDateTime=0x2b1954f0, ftLastAccessTime.dwHighDateTime=0x1d5def2, ftLastWriteTime.dwLowDateTime=0x2b1954f0, ftLastWriteTime.dwHighDateTime=0x1d5def2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.818] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cc94db0, ftCreationTime.dwHighDateTime=0x1d5dfc2, ftLastAccessTime.dwLowDateTime=0xe6943650, ftLastAccessTime.dwHighDateTime=0x1d5dd76, ftLastWriteTime.dwLowDateTime=0xe6943650, ftLastWriteTime.dwHighDateTime=0x1d5dd76, nFileSizeHigh=0x0, nFileSizeLow=0x17467, dwReserved0=0x0, dwReserved1=0x0, cFileName="0M71KkelAbwC8.xlsx", cAlternateFileName="0M71KK~1.XLS")) returned 1 [0080.818] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72390d70, ftCreationTime.dwHighDateTime=0x1d5e0e2, ftLastAccessTime.dwLowDateTime=0xd22881f0, ftLastAccessTime.dwHighDateTime=0x1d5d824, ftLastWriteTime.dwLowDateTime=0xd22881f0, ftLastWriteTime.dwHighDateTime=0x1d5d824, nFileSizeHigh=0x0, nFileSizeLow=0xe90b, dwReserved0=0x0, dwReserved1=0x0, cFileName="8KtwPy9.ods", cAlternateFileName="")) returned 1 [0080.818] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5326c490, ftCreationTime.dwHighDateTime=0x1d5e641, ftLastAccessTime.dwLowDateTime=0xd4453260, ftLastAccessTime.dwHighDateTime=0x1d5e604, ftLastWriteTime.dwLowDateTime=0xd4453260, ftLastWriteTime.dwHighDateTime=0x1d5e604, nFileSizeHigh=0x0, nFileSizeLow=0xccbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="C1 ODW887G.pps", cAlternateFileName="C1ODW8~1.PPS")) returned 1 [0080.818] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cbaf330, ftCreationTime.dwHighDateTime=0x1d5e49a, ftLastAccessTime.dwLowDateTime=0x8c4585f0, ftLastAccessTime.dwHighDateTime=0x1d5dc18, ftLastWriteTime.dwLowDateTime=0x8c4585f0, ftLastWriteTime.dwHighDateTime=0x1d5dc18, nFileSizeHigh=0x0, nFileSizeLow=0x21c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGsHL2wHSwlnfH.xlsx", cAlternateFileName="CGSHL2~1.XLS")) returned 1 [0080.818] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40605e40, ftCreationTime.dwHighDateTime=0x1d5df9b, ftLastAccessTime.dwLowDateTime=0xec13ee50, ftLastAccessTime.dwHighDateTime=0x1d5de65, ftLastWriteTime.dwLowDateTime=0xec13ee50, ftLastWriteTime.dwHighDateTime=0x1d5de65, nFileSizeHigh=0x0, nFileSizeLow=0x9352, dwReserved0=0x0, dwReserved1=0x0, cFileName="gxxzHBltxEQuwc.ots", cAlternateFileName="GXXZHB~1.OTS")) returned 1 [0080.819] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d995d70, ftCreationTime.dwHighDateTime=0x1d5e676, ftLastAccessTime.dwLowDateTime=0x4c236520, ftLastAccessTime.dwHighDateTime=0x1d5e747, ftLastWriteTime.dwLowDateTime=0x4c236520, ftLastWriteTime.dwHighDateTime=0x1d5e747, nFileSizeHigh=0x0, nFileSizeLow=0xa281, dwReserved0=0x0, dwReserved1=0x0, cFileName="xcr2uKhKZ8yefXR72fS.doc", cAlternateFileName="XCR2UK~1.DOC")) returned 1 [0080.819] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf7a9d30, ftCreationTime.dwHighDateTime=0x1d5dadb, ftLastAccessTime.dwLowDateTime=0x6af1d570, ftLastAccessTime.dwHighDateTime=0x1d5de3e, ftLastWriteTime.dwLowDateTime=0x6af1d570, ftLastWriteTime.dwHighDateTime=0x1d5de3e, nFileSizeHigh=0x0, nFileSizeLow=0xd62f, dwReserved0=0x0, dwReserved1=0x0, cFileName="YEJ-LkWtdHr.xlsx", cAlternateFileName="YEJ-LK~1.XLS")) returned 1 [0080.819] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf7a9d30, ftCreationTime.dwHighDateTime=0x1d5dadb, ftLastAccessTime.dwLowDateTime=0x6af1d570, ftLastAccessTime.dwHighDateTime=0x1d5de3e, ftLastWriteTime.dwLowDateTime=0x6af1d570, ftLastWriteTime.dwHighDateTime=0x1d5de3e, nFileSizeHigh=0x0, nFileSizeLow=0xd62f, dwReserved0=0x0, dwReserved1=0x0, cFileName="YEJ-LkWtdHr.xlsx", cAlternateFileName="YEJ-LK~1.XLS")) returned 0 [0080.819] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0080.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf07c) returned 1 [0080.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf088) returned 1 [0080.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf0bc) returned 1 [0080.819] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rIREdumyZRX80jt2", nBufferLength=0x105, lpBuffer=0x5bbebc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rIREdumyZRX80jt2", lpFilePart=0x0) returned 0x38 [0080.819] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rIREdumyZRX80jt2\\", nBufferLength=0x105, lpBuffer=0x5bbeb98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rIREdumyZRX80jt2\\", lpFilePart=0x0) returned 0x39 [0080.819] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rIREdumyZRX80jt2\\*", lpFindFileData=0x5bbede4 | out: lpFindFileData=0x5bbede4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x827cc010, ftCreationTime.dwHighDateTime=0x1d5d95c, ftLastAccessTime.dwLowDateTime=0x2b1954f0, ftLastAccessTime.dwHighDateTime=0x1d5def2, ftLastWriteTime.dwLowDateTime=0x2b1954f0, ftLastWriteTime.dwHighDateTime=0x1d5def2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0080.820] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x827cc010, ftCreationTime.dwHighDateTime=0x1d5d95c, ftLastAccessTime.dwLowDateTime=0x2b1954f0, ftLastAccessTime.dwHighDateTime=0x1d5def2, ftLastWriteTime.dwLowDateTime=0x2b1954f0, ftLastWriteTime.dwHighDateTime=0x1d5def2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.820] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cc94db0, ftCreationTime.dwHighDateTime=0x1d5dfc2, ftLastAccessTime.dwLowDateTime=0xe6943650, ftLastAccessTime.dwHighDateTime=0x1d5dd76, ftLastWriteTime.dwLowDateTime=0xe6943650, ftLastWriteTime.dwHighDateTime=0x1d5dd76, nFileSizeHigh=0x0, nFileSizeLow=0x17467, dwReserved0=0x0, dwReserved1=0x0, cFileName="0M71KkelAbwC8.xlsx", cAlternateFileName="0M71KK~1.XLS")) returned 1 [0080.820] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72390d70, ftCreationTime.dwHighDateTime=0x1d5e0e2, ftLastAccessTime.dwLowDateTime=0xd22881f0, ftLastAccessTime.dwHighDateTime=0x1d5d824, ftLastWriteTime.dwLowDateTime=0xd22881f0, ftLastWriteTime.dwHighDateTime=0x1d5d824, nFileSizeHigh=0x0, nFileSizeLow=0xe90b, dwReserved0=0x0, dwReserved1=0x0, cFileName="8KtwPy9.ods", cAlternateFileName="")) returned 1 [0080.820] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5326c490, ftCreationTime.dwHighDateTime=0x1d5e641, ftLastAccessTime.dwLowDateTime=0xd4453260, ftLastAccessTime.dwHighDateTime=0x1d5e604, ftLastWriteTime.dwLowDateTime=0xd4453260, ftLastWriteTime.dwHighDateTime=0x1d5e604, nFileSizeHigh=0x0, nFileSizeLow=0xccbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="C1 ODW887G.pps", cAlternateFileName="C1ODW8~1.PPS")) returned 1 [0080.820] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cbaf330, ftCreationTime.dwHighDateTime=0x1d5e49a, ftLastAccessTime.dwLowDateTime=0x8c4585f0, ftLastAccessTime.dwHighDateTime=0x1d5dc18, ftLastWriteTime.dwLowDateTime=0x8c4585f0, ftLastWriteTime.dwHighDateTime=0x1d5dc18, nFileSizeHigh=0x0, nFileSizeLow=0x21c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGsHL2wHSwlnfH.xlsx", cAlternateFileName="CGSHL2~1.XLS")) returned 1 [0080.820] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40605e40, ftCreationTime.dwHighDateTime=0x1d5df9b, ftLastAccessTime.dwLowDateTime=0xec13ee50, ftLastAccessTime.dwHighDateTime=0x1d5de65, ftLastWriteTime.dwLowDateTime=0xec13ee50, ftLastWriteTime.dwHighDateTime=0x1d5de65, nFileSizeHigh=0x0, nFileSizeLow=0x9352, dwReserved0=0x0, dwReserved1=0x0, cFileName="gxxzHBltxEQuwc.ots", cAlternateFileName="GXXZHB~1.OTS")) returned 1 [0080.820] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d995d70, ftCreationTime.dwHighDateTime=0x1d5e676, ftLastAccessTime.dwLowDateTime=0x4c236520, ftLastAccessTime.dwHighDateTime=0x1d5e747, ftLastWriteTime.dwLowDateTime=0x4c236520, ftLastWriteTime.dwHighDateTime=0x1d5e747, nFileSizeHigh=0x0, nFileSizeLow=0xa281, dwReserved0=0x0, dwReserved1=0x0, cFileName="xcr2uKhKZ8yefXR72fS.doc", cAlternateFileName="XCR2UK~1.DOC")) returned 1 [0080.821] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf7a9d30, ftCreationTime.dwHighDateTime=0x1d5dadb, ftLastAccessTime.dwLowDateTime=0x6af1d570, ftLastAccessTime.dwHighDateTime=0x1d5de3e, ftLastWriteTime.dwLowDateTime=0x6af1d570, ftLastWriteTime.dwHighDateTime=0x1d5de3e, nFileSizeHigh=0x0, nFileSizeLow=0xd62f, dwReserved0=0x0, dwReserved1=0x0, cFileName="YEJ-LkWtdHr.xlsx", cAlternateFileName="YEJ-LK~1.XLS")) returned 1 [0080.821] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0080.821] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0080.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf07c) returned 1 [0080.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf088) returned 1 [0080.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf100) returned 1 [0080.821] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", nBufferLength=0x105, lpBuffer=0x5bbec08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", lpFilePart=0x0) returned 0x27 [0080.821] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", nBufferLength=0x105, lpBuffer=0x5bbebdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", lpFilePart=0x0) returned 0x28 [0080.821] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*", lpFindFileData=0x5bbee28 | out: lpFindFileData=0x5bbee28*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdbe2d4a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbe2d4a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0080.822] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdbe2d4a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbe2d4a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.822] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc0cd120, ftCreationTime.dwHighDateTime=0x1d58431, ftLastAccessTime.dwLowDateTime=0xdea7f8a0, ftLastAccessTime.dwHighDateTime=0x1d5c4c1, ftLastWriteTime.dwLowDateTime=0xdea7f8a0, ftLastWriteTime.dwHighDateTime=0x1d5c4c1, nFileSizeHigh=0x0, nFileSizeLow=0x677e, dwReserved0=0x0, dwReserved1=0x0, cFileName="8-y4LOfY.xlsx", cAlternateFileName="8-Y4LO~1.XLS")) returned 1 [0080.822] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4363460, ftCreationTime.dwHighDateTime=0x1d57957, ftLastAccessTime.dwLowDateTime=0x84e126c0, ftLastAccessTime.dwHighDateTime=0x1d5e65e, ftLastWriteTime.dwLowDateTime=0x84e126c0, ftLastWriteTime.dwHighDateTime=0x1d5e65e, nFileSizeHigh=0x0, nFileSizeLow=0x11d97, dwReserved0=0x0, dwReserved1=0x0, cFileName="82nzDGjI 7XWXV_l.xlsx", cAlternateFileName="82NZDG~1.XLS")) returned 1 [0080.822] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40528c90, ftCreationTime.dwHighDateTime=0x1d5ae0c, ftLastAccessTime.dwLowDateTime=0x47d76e50, ftLastAccessTime.dwHighDateTime=0x1d56608, ftLastWriteTime.dwLowDateTime=0x47d76e50, ftLastWriteTime.dwHighDateTime=0x1d56608, nFileSizeHigh=0x0, nFileSizeLow=0xc77f, dwReserved0=0x0, dwReserved1=0x0, cFileName="8nrt26S7PviA02dyk.pptx", cAlternateFileName="8NRT26~1.PPT")) returned 1 [0080.822] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bb6c3f0, ftCreationTime.dwHighDateTime=0x1d55b36, ftLastAccessTime.dwLowDateTime=0x94f6d9a0, ftLastAccessTime.dwHighDateTime=0x1d5a6b3, ftLastWriteTime.dwLowDateTime=0x94f6d9a0, ftLastWriteTime.dwHighDateTime=0x1d5a6b3, nFileSizeHigh=0x0, nFileSizeLow=0x10517, dwReserved0=0x0, dwReserved1=0x0, cFileName="aV3XYxvgegC.docx", cAlternateFileName="AV3XYX~1.DOC")) returned 1 [0080.822] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddba0680, ftCreationTime.dwHighDateTime=0x1d5e3cb, ftLastAccessTime.dwLowDateTime=0xe835b1c0, ftLastAccessTime.dwHighDateTime=0x1d5e1de, ftLastWriteTime.dwLowDateTime=0xe835b1c0, ftLastWriteTime.dwHighDateTime=0x1d5e1de, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="b80m5N3teF4Nk1P", cAlternateFileName="B80M5N~1")) returned 1 [0080.822] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0080.823] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fbfcc80, ftCreationTime.dwHighDateTime=0x1d5b650, ftLastAccessTime.dwLowDateTime=0x7a8995f0, ftLastAccessTime.dwHighDateTime=0x1d5dee2, ftLastWriteTime.dwLowDateTime=0x7a8995f0, ftLastWriteTime.dwHighDateTime=0x1d5dee2, nFileSizeHigh=0x0, nFileSizeLow=0x12ca8, dwReserved0=0x0, dwReserved1=0x0, cFileName="gcBW 4OQaj.pptx", cAlternateFileName="GCBW4O~1.PPT")) returned 1 [0080.823] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4727ea0, ftCreationTime.dwHighDateTime=0x1d5a84b, ftLastAccessTime.dwLowDateTime=0x9643e170, ftLastAccessTime.dwHighDateTime=0x1d56d2b, ftLastWriteTime.dwLowDateTime=0x9643e170, ftLastWriteTime.dwHighDateTime=0x1d56d2b, nFileSizeHigh=0x0, nFileSizeLow=0xc01d, dwReserved0=0x0, dwReserved1=0x0, cFileName="gqp9rLKCCKsd05.docx", cAlternateFileName="GQP9RL~1.DOC")) returned 1 [0080.823] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0f4c730, ftCreationTime.dwHighDateTime=0x1d5d912, ftLastAccessTime.dwLowDateTime=0x4ee4cfe0, ftLastAccessTime.dwHighDateTime=0x1d5d871, ftLastWriteTime.dwLowDateTime=0x4ee4cfe0, ftLastWriteTime.dwHighDateTime=0x1d5d871, nFileSizeHigh=0x0, nFileSizeLow=0x133a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="h8I86FUVFr.docx", cAlternateFileName="H8I86F~1.DOC")) returned 1 [0080.823] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7fcb00, ftCreationTime.dwHighDateTime=0x1d5c170, ftLastAccessTime.dwLowDateTime=0x55e037b0, ftLastAccessTime.dwHighDateTime=0x1d5d297, ftLastWriteTime.dwLowDateTime=0x55e037b0, ftLastWriteTime.dwHighDateTime=0x1d5d297, nFileSizeHigh=0x0, nFileSizeLow=0x16388, dwReserved0=0x0, dwReserved1=0x0, cFileName="jQFpDdnAiB98NT.docx", cAlternateFileName="JQFPDD~1.DOC")) returned 1 [0080.823] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec194c0, ftCreationTime.dwHighDateTime=0x1d58036, ftLastAccessTime.dwLowDateTime=0xc3abd700, ftLastAccessTime.dwHighDateTime=0x1d5de26, ftLastWriteTime.dwLowDateTime=0xc3abd700, ftLastWriteTime.dwHighDateTime=0x1d5de26, nFileSizeHigh=0x0, nFileSizeLow=0x1303d, dwReserved0=0x0, dwReserved1=0x0, cFileName="KskcceHMsX7rT.xlsx", cAlternateFileName="KSKCCE~1.XLS")) returned 1 [0080.823] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0080.824] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0080.824] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0080.824] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0080.824] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ddcd580, ftCreationTime.dwHighDateTime=0x1d5a5f2, ftLastAccessTime.dwLowDateTime=0xea013500, ftLastAccessTime.dwHighDateTime=0x1d56160, ftLastWriteTime.dwLowDateTime=0xea013500, ftLastWriteTime.dwHighDateTime=0x1d56160, nFileSizeHigh=0x0, nFileSizeLow=0xd513, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nlXNmDoCq.pptx", cAlternateFileName="NLXNMD~1.PPT")) returned 1 [0080.824] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5f72ff0, ftCreationTime.dwHighDateTime=0x1d5a3ea, ftLastAccessTime.dwLowDateTime=0x76911260, ftLastAccessTime.dwHighDateTime=0x1d5a8ba, ftLastWriteTime.dwLowDateTime=0x76911260, ftLastWriteTime.dwHighDateTime=0x1d5a8ba, nFileSizeHigh=0x0, nFileSizeLow=0x1190c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oiYNJq9q1YIrgX.docx", cAlternateFileName="OIYNJQ~1.DOC")) returned 1 [0080.824] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8a4af3c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8a4af3c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0080.825] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedc3a100, ftCreationTime.dwHighDateTime=0x1d5dfa0, ftLastAccessTime.dwLowDateTime=0x63e311d0, ftLastAccessTime.dwHighDateTime=0x1d5db06, ftLastWriteTime.dwLowDateTime=0x63e311d0, ftLastWriteTime.dwHighDateTime=0x1d5db06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oX2xE8wIX", cAlternateFileName="OX2XE8~1")) returned 1 [0080.825] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78e00870, ftCreationTime.dwHighDateTime=0x1d59ca6, ftLastAccessTime.dwLowDateTime=0xb4a95c30, ftLastAccessTime.dwHighDateTime=0x1d580bd, ftLastWriteTime.dwLowDateTime=0xb4a95c30, ftLastWriteTime.dwHighDateTime=0x1d580bd, nFileSizeHigh=0x0, nFileSizeLow=0x930d, dwReserved0=0x0, dwReserved1=0x0, cFileName="PFyZqu_bN8iiDcWbYu.docx", cAlternateFileName="PFYZQU~1.DOC")) returned 1 [0080.825] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe817f210, ftCreationTime.dwHighDateTime=0x1d5e7e8, ftLastAccessTime.dwLowDateTime=0xf4cbeb50, ftLastAccessTime.dwHighDateTime=0x1d57ba6, ftLastWriteTime.dwLowDateTime=0xf4cbeb50, ftLastWriteTime.dwHighDateTime=0x1d57ba6, nFileSizeHigh=0x0, nFileSizeLow=0x178c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qAMKrJ s5aXEM2 DfBx.xlsx", cAlternateFileName="QAMKRJ~1.XLS")) returned 1 [0080.825] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a2ea540, ftCreationTime.dwHighDateTime=0x1d5da48, ftLastAccessTime.dwLowDateTime=0x52cdcad0, ftLastAccessTime.dwHighDateTime=0x1d5db9b, ftLastWriteTime.dwLowDateTime=0x52cdcad0, ftLastWriteTime.dwHighDateTime=0x1d5db9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QmUng5_ZXRVu", cAlternateFileName="QMUNG5~1")) returned 1 [0080.825] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a7ac60, ftCreationTime.dwHighDateTime=0x1d5e050, ftLastAccessTime.dwLowDateTime=0x44695690, ftLastAccessTime.dwHighDateTime=0x1d5d8fc, ftLastWriteTime.dwLowDateTime=0x44695690, ftLastWriteTime.dwHighDateTime=0x1d5d8fc, nFileSizeHigh=0x0, nFileSizeLow=0x11028, dwReserved0=0x0, dwReserved1=0x0, cFileName="R6MuKWr660ExY0xOP1YZ.doc", cAlternateFileName="R6MUKW~1.DOC")) returned 1 [0080.825] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x827cc010, ftCreationTime.dwHighDateTime=0x1d5d95c, ftLastAccessTime.dwLowDateTime=0x2b1954f0, ftLastAccessTime.dwHighDateTime=0x1d5def2, ftLastWriteTime.dwLowDateTime=0x2b1954f0, ftLastWriteTime.dwHighDateTime=0x1d5def2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rIREdumyZRX80jt2", cAlternateFileName="RIREDU~1")) returned 1 [0080.826] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdecb2f10, ftCreationTime.dwHighDateTime=0x1d5d8ac, ftLastAccessTime.dwLowDateTime=0x93a8cb30, ftLastAccessTime.dwHighDateTime=0x1d5bafe, ftLastWriteTime.dwLowDateTime=0x93a8cb30, ftLastWriteTime.dwHighDateTime=0x1d5bafe, nFileSizeHigh=0x0, nFileSizeLow=0x67cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RPane0VXyl-S.pptx", cAlternateFileName="RPANE0~1.PPT")) returned 1 [0080.826] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbeb1ff0, ftCreationTime.dwHighDateTime=0x1d568b4, ftLastAccessTime.dwLowDateTime=0x55cd4140, ftLastAccessTime.dwHighDateTime=0x1d5b6d2, ftLastWriteTime.dwLowDateTime=0x55cd4140, ftLastWriteTime.dwHighDateTime=0x1d5b6d2, nFileSizeHigh=0x0, nFileSizeLow=0xf4a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="XErx7u1YawDfT4d.xlsx", cAlternateFileName="XERX7U~1.XLS")) returned 1 [0080.826] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0124330, ftCreationTime.dwHighDateTime=0x1d56c09, ftLastAccessTime.dwLowDateTime=0x4e92e4d0, ftLastAccessTime.dwHighDateTime=0x1d59c64, ftLastWriteTime.dwLowDateTime=0x4e92e4d0, ftLastWriteTime.dwHighDateTime=0x1d59c64, nFileSizeHigh=0x0, nFileSizeLow=0x819b, dwReserved0=0x0, dwReserved1=0x0, cFileName="yEsc.pptx", cAlternateFileName="YESC~1.PPT")) returned 1 [0080.826] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0080.826] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0080.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf0c0) returned 1 [0080.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf0cc) returned 1 [0080.826] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", nBufferLength=0x105, lpBuffer=0x5bbec6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", lpFilePart=0x0) returned 0x27 [0080.827] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x5bbeb0c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0080.827] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Documents.txt", nBufferLength=0x105, lpBuffer=0x5bbeb20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Documents.txt", lpFilePart=0x0) returned 0x85 [0080.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf014) returned 1 [0080.827] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Documents.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs\\documents.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x498 [0080.828] GetFileType (hFile=0x498) returned 0x1 [0080.828] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf010) returned 1 [0080.828] GetFileType (hFile=0x498) returned 0x1 [0080.828] WriteFile (in: hFile=0x498, lpBuffer=0x2730674*, nNumberOfBytesToWrite=0x559, lpNumberOfBytesWritten=0x5bbf0ac, lpOverlapped=0x0 | out: lpBuffer=0x2730674*, lpNumberOfBytesWritten=0x5bbf0ac*=0x559, lpOverlapped=0x0) returned 1 [0080.829] CloseHandle (hObject=0x498) returned 1 [0080.830] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", nBufferLength=0x105, lpBuffer=0x5bbec38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", lpFilePart=0x0) returned 0x26 [0080.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf094) returned 1 [0080.830] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures"), fInfoLevelId=0x0, lpFileInformation=0x5bbf110 | out: lpFileInformation=0x5bbf110*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdbf84100, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf84100, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3000)) returned 1 [0080.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf090) returned 1 [0080.830] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", nBufferLength=0x105, lpBuffer=0x5bbec38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", lpFilePart=0x0) returned 0x26 [0080.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf100) returned 1 [0080.830] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", nBufferLength=0x105, lpBuffer=0x5bbec08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", lpFilePart=0x0) returned 0x26 [0080.830] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", nBufferLength=0x105, lpBuffer=0x5bbebdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", lpFilePart=0x0) returned 0x27 [0080.830] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*", lpFindFileData=0x5bbee28 | out: lpFindFileData=0x5bbee28*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdbf84100, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf84100, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0080.831] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdbf84100, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf84100, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.831] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c28eb0, ftCreationTime.dwHighDateTime=0x1d5dafe, ftLastAccessTime.dwLowDateTime=0xe512e770, ftLastAccessTime.dwHighDateTime=0x1d5dc0b, ftLastWriteTime.dwLowDateTime=0xe512e770, ftLastWriteTime.dwHighDateTime=0x1d5dc0b, nFileSizeHigh=0x0, nFileSizeLow=0x89a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="-BRKLxTrDQf7q1zC--.bmp", cAlternateFileName="-BRKLX~1.BMP")) returned 1 [0080.831] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf9c5bb0, ftCreationTime.dwHighDateTime=0x1d5d9b2, ftLastAccessTime.dwLowDateTime=0x8d7bb590, ftLastAccessTime.dwHighDateTime=0x1d5da63, ftLastWriteTime.dwLowDateTime=0x8d7bb590, ftLastWriteTime.dwHighDateTime=0x1d5da63, nFileSizeHigh=0x0, nFileSizeLow=0x1639f, dwReserved0=0x0, dwReserved1=0x0, cFileName="3fOOr-tj.gif", cAlternateFileName="")) returned 1 [0080.831] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d250da0, ftCreationTime.dwHighDateTime=0x1d5df45, ftLastAccessTime.dwLowDateTime=0x333857f0, ftLastAccessTime.dwHighDateTime=0x1d5de78, ftLastWriteTime.dwLowDateTime=0x333857f0, ftLastWriteTime.dwHighDateTime=0x1d5de78, nFileSizeHigh=0x0, nFileSizeLow=0x91b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="71MI9ndSEEU5tAC.bmp", cAlternateFileName="71MI9N~1.BMP")) returned 1 [0080.831] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cc0f880, ftCreationTime.dwHighDateTime=0x1d5dbbf, ftLastAccessTime.dwLowDateTime=0x2d1ca300, ftLastAccessTime.dwHighDateTime=0x1d5d9e4, ftLastWriteTime.dwLowDateTime=0x2d1ca300, ftLastWriteTime.dwHighDateTime=0x1d5d9e4, nFileSizeHigh=0x0, nFileSizeLow=0x706d, dwReserved0=0x0, dwReserved1=0x0, cFileName="A5lN-_K.gif", cAlternateFileName="")) returned 1 [0080.832] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e410cd0, ftCreationTime.dwHighDateTime=0x1d5de52, ftLastAccessTime.dwLowDateTime=0xee400e40, ftLastAccessTime.dwHighDateTime=0x1d5d8a0, ftLastWriteTime.dwLowDateTime=0xee400e40, ftLastWriteTime.dwHighDateTime=0x1d5d8a0, nFileSizeHigh=0x0, nFileSizeLow=0x10654, dwReserved0=0x0, dwReserved1=0x0, cFileName="aD7vAKGbt-teGRGOf.bmp", cAlternateFileName="AD7VAK~1.BMP")) returned 1 [0080.832] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce82910, ftCreationTime.dwHighDateTime=0x1d5dbb8, ftLastAccessTime.dwLowDateTime=0x1fe522b0, ftLastAccessTime.dwHighDateTime=0x1d5df6c, ftLastWriteTime.dwLowDateTime=0x1fe522b0, ftLastWriteTime.dwHighDateTime=0x1d5df6c, nFileSizeHigh=0x0, nFileSizeLow=0xabad, dwReserved0=0x0, dwReserved1=0x0, cFileName="aVBuptDTVXCYrU.gif", cAlternateFileName="AVBUPT~1.GIF")) returned 1 [0080.832] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62eee2f0, ftCreationTime.dwHighDateTime=0x1d5e62c, ftLastAccessTime.dwLowDateTime=0xd50dd660, ftLastAccessTime.dwHighDateTime=0x1d5e600, ftLastWriteTime.dwLowDateTime=0xd50dd660, ftLastWriteTime.dwHighDateTime=0x1d5e600, nFileSizeHigh=0x0, nFileSizeLow=0xf955, dwReserved0=0x0, dwReserved1=0x0, cFileName="BGBHbSpDEyu-XJdGi6.jpg", cAlternateFileName="BGBHBS~1.JPG")) returned 1 [0080.832] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x436e79b0, ftCreationTime.dwHighDateTime=0x1d5da9a, ftLastAccessTime.dwLowDateTime=0xda136b60, ftLastAccessTime.dwHighDateTime=0x1d5dde6, ftLastWriteTime.dwLowDateTime=0xda136b60, ftLastWriteTime.dwHighDateTime=0x1d5dde6, nFileSizeHigh=0x0, nFileSizeLow=0xc7ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="c2i9T9ZdZ0iB.bmp", cAlternateFileName="C2I9T9~1.BMP")) returned 1 [0080.832] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a0d6c70, ftCreationTime.dwHighDateTime=0x1d5db58, ftLastAccessTime.dwLowDateTime=0xbe041b80, ftLastAccessTime.dwHighDateTime=0x1d5e675, ftLastWriteTime.dwLowDateTime=0xbe041b80, ftLastWriteTime.dwHighDateTime=0x1d5e675, nFileSizeHigh=0x0, nFileSizeLow=0x8b5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="cmZkXcJ0NAd803xVvT.jpg", cAlternateFileName="CMZKXC~1.JPG")) returned 1 [0080.832] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x390a43d0, ftCreationTime.dwHighDateTime=0x1d5dd94, ftLastAccessTime.dwLowDateTime=0x89c84590, ftLastAccessTime.dwHighDateTime=0x1d5d9d6, ftLastWriteTime.dwLowDateTime=0x89c84590, ftLastWriteTime.dwHighDateTime=0x1d5d9d6, nFileSizeHigh=0x0, nFileSizeLow=0xa9ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="CZ1cCRQ_KLTfRI8wQoMn.png", cAlternateFileName="CZ1CCR~1.PNG")) returned 1 [0080.833] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31d69690, ftCreationTime.dwHighDateTime=0x1d5e050, ftLastAccessTime.dwLowDateTime=0xad43a4f0, ftLastAccessTime.dwHighDateTime=0x1d5e3cd, ftLastWriteTime.dwLowDateTime=0xad43a4f0, ftLastWriteTime.dwHighDateTime=0x1d5e3cd, nFileSizeHigh=0x0, nFileSizeLow=0x25fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="CZbr9DWttkzQtmagXJ-z.gif", cAlternateFileName="CZBR9D~1.GIF")) returned 1 [0080.833] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7710670, ftCreationTime.dwHighDateTime=0x1d5d9e7, ftLastAccessTime.dwLowDateTime=0x5bcb95a0, ftLastAccessTime.dwHighDateTime=0x1d5e554, ftLastWriteTime.dwLowDateTime=0x5bcb95a0, ftLastWriteTime.dwHighDateTime=0x1d5e554, nFileSizeHigh=0x0, nFileSizeLow=0x1eef, dwReserved0=0x0, dwReserved1=0x0, cFileName="ddr1lcuPdatwN3L2.bmp", cAlternateFileName="DDR1LC~1.BMP")) returned 1 [0080.833] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0080.833] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f20cbe0, ftCreationTime.dwHighDateTime=0x1d5df45, ftLastAccessTime.dwLowDateTime=0xf86dd2c0, ftLastAccessTime.dwHighDateTime=0x1d5dfd6, ftLastWriteTime.dwLowDateTime=0xf86dd2c0, ftLastWriteTime.dwHighDateTime=0x1d5dfd6, nFileSizeHigh=0x0, nFileSizeLow=0x484b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ESRCIbGBEY9iOjypF4Be.gif", cAlternateFileName="ESRCIB~1.GIF")) returned 1 [0080.833] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34b9e9a0, ftCreationTime.dwHighDateTime=0x1d5e6a1, ftLastAccessTime.dwLowDateTime=0x8a30f8f0, ftLastAccessTime.dwHighDateTime=0x1d5e6fc, ftLastWriteTime.dwLowDateTime=0x8a30f8f0, ftLastWriteTime.dwHighDateTime=0x1d5e6fc, nFileSizeHigh=0x0, nFileSizeLow=0x1298f, dwReserved0=0x0, dwReserved1=0x0, cFileName="fKjFMjXeY69.jpg", cAlternateFileName="FKJFMJ~1.JPG")) returned 1 [0080.833] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24384df0, ftCreationTime.dwHighDateTime=0x1d5e021, ftLastAccessTime.dwLowDateTime=0xca923c60, ftLastAccessTime.dwHighDateTime=0x1d5e693, ftLastWriteTime.dwLowDateTime=0xca923c60, ftLastWriteTime.dwHighDateTime=0x1d5e693, nFileSizeHigh=0x0, nFileSizeLow=0x5de7, dwReserved0=0x0, dwReserved1=0x0, cFileName="fYPmZ4LF3.jpg", cAlternateFileName="FYPMZ4~1.JPG")) returned 1 [0080.834] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99472f40, ftCreationTime.dwHighDateTime=0x1d5e1bf, ftLastAccessTime.dwLowDateTime=0xc5385bc0, ftLastAccessTime.dwHighDateTime=0x1d5e72c, ftLastWriteTime.dwLowDateTime=0xc5385bc0, ftLastWriteTime.dwHighDateTime=0x1d5e72c, nFileSizeHigh=0x0, nFileSizeLow=0x17bd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="g2UGB7FSLw09NkiqQUi.png", cAlternateFileName="G2UGB7~1.PNG")) returned 1 [0080.834] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92bd6600, ftCreationTime.dwHighDateTime=0x1d5d998, ftLastAccessTime.dwLowDateTime=0x9878660, ftLastAccessTime.dwHighDateTime=0x1d5e670, ftLastWriteTime.dwLowDateTime=0x9878660, ftLastWriteTime.dwHighDateTime=0x1d5e670, nFileSizeHigh=0x0, nFileSizeLow=0x12bdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="gn-ZjDb.png", cAlternateFileName="")) returned 1 [0080.834] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7f32b90, ftCreationTime.dwHighDateTime=0x1d5e0c1, ftLastAccessTime.dwLowDateTime=0xa6232e70, ftLastAccessTime.dwHighDateTime=0x1d5e350, ftLastWriteTime.dwLowDateTime=0xa6232e70, ftLastWriteTime.dwHighDateTime=0x1d5e350, nFileSizeHigh=0x0, nFileSizeLow=0x794d, dwReserved0=0x0, dwReserved1=0x0, cFileName="GxPk.png", cAlternateFileName="")) returned 1 [0080.834] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90546e50, ftCreationTime.dwHighDateTime=0x1d5df14, ftLastAccessTime.dwLowDateTime=0x5c2ac20, ftLastAccessTime.dwHighDateTime=0x1d5d8fc, ftLastWriteTime.dwLowDateTime=0x5c2ac20, ftLastWriteTime.dwHighDateTime=0x1d5d8fc, nFileSizeHigh=0x0, nFileSizeLow=0x27b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="HRpZ-PAv6bn.gif", cAlternateFileName="HRPZ-P~1.GIF")) returned 1 [0080.834] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f451b80, ftCreationTime.dwHighDateTime=0x1d5dda5, ftLastAccessTime.dwLowDateTime=0x57544d70, ftLastAccessTime.dwHighDateTime=0x1d5e0b6, ftLastWriteTime.dwLowDateTime=0x57544d70, ftLastWriteTime.dwHighDateTime=0x1d5e0b6, nFileSizeHigh=0x0, nFileSizeLow=0x67f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="hXBfoDBSVT4yoHp.bmp", cAlternateFileName="HXBFOD~1.BMP")) returned 1 [0080.834] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c0621a0, ftCreationTime.dwHighDateTime=0x1d5d7ce, ftLastAccessTime.dwLowDateTime=0xc9c95ae0, ftLastAccessTime.dwHighDateTime=0x1d5de3f, ftLastWriteTime.dwLowDateTime=0xc9c95ae0, ftLastWriteTime.dwHighDateTime=0x1d5de3f, nFileSizeHigh=0x0, nFileSizeLow=0x12108, dwReserved0=0x0, dwReserved1=0x0, cFileName="HxxMXX3HX.jpg", cAlternateFileName="HXXMXX~1.JPG")) returned 1 [0080.835] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24316dc0, ftCreationTime.dwHighDateTime=0x1d5db0b, ftLastAccessTime.dwLowDateTime=0x95b35a0, ftLastAccessTime.dwHighDateTime=0x1d5db40, ftLastWriteTime.dwLowDateTime=0x95b35a0, ftLastWriteTime.dwHighDateTime=0x1d5db40, nFileSizeHigh=0x0, nFileSizeLow=0xce7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ixfl.png", cAlternateFileName="")) returned 1 [0080.835] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7cb3a40, ftCreationTime.dwHighDateTime=0x1d5db06, ftLastAccessTime.dwLowDateTime=0x71cc3e30, ftLastAccessTime.dwHighDateTime=0x1d5e6fe, ftLastWriteTime.dwLowDateTime=0x71cc3e30, ftLastWriteTime.dwHighDateTime=0x1d5e6fe, nFileSizeHigh=0x0, nFileSizeLow=0xf6ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="jeDUyPaiwFP-.bmp", cAlternateFileName="JEDUYP~1.BMP")) returned 1 [0080.835] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19801fa0, ftCreationTime.dwHighDateTime=0x1d5dd10, ftLastAccessTime.dwLowDateTime=0xabade880, ftLastAccessTime.dwHighDateTime=0x1d5dab3, ftLastWriteTime.dwLowDateTime=0xabade880, ftLastWriteTime.dwHighDateTime=0x1d5dab3, nFileSizeHigh=0x0, nFileSizeLow=0xd492, dwReserved0=0x0, dwReserved1=0x0, cFileName="lXsi6Keyn-.jpg", cAlternateFileName="LXSI6K~1.JPG")) returned 1 [0080.835] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77368240, ftCreationTime.dwHighDateTime=0x1d5e172, ftLastAccessTime.dwLowDateTime=0xd76983b0, ftLastAccessTime.dwHighDateTime=0x1d5dfec, ftLastWriteTime.dwLowDateTime=0xd76983b0, ftLastWriteTime.dwHighDateTime=0x1d5dfec, nFileSizeHigh=0x0, nFileSizeLow=0x5ea5, dwReserved0=0x0, dwReserved1=0x0, cFileName="mm358wJa6Q8te1kBB0.bmp", cAlternateFileName="MM358W~1.BMP")) returned 1 [0080.835] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37790040, ftCreationTime.dwHighDateTime=0x1d5da85, ftLastAccessTime.dwLowDateTime=0xb43945e0, ftLastAccessTime.dwHighDateTime=0x1d5deef, ftLastWriteTime.dwLowDateTime=0xb43945e0, ftLastWriteTime.dwHighDateTime=0x1d5deef, nFileSizeHigh=0x0, nFileSizeLow=0xf117, dwReserved0=0x0, dwReserved1=0x0, cFileName="oSsCw2.bmp", cAlternateFileName="")) returned 1 [0080.835] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e55d70, ftCreationTime.dwHighDateTime=0x1d5e37a, ftLastAccessTime.dwLowDateTime=0x750cfb50, ftLastAccessTime.dwHighDateTime=0x1d5e30e, ftLastWriteTime.dwLowDateTime=0x750cfb50, ftLastWriteTime.dwHighDateTime=0x1d5e30e, nFileSizeHigh=0x0, nFileSizeLow=0x8c9d, dwReserved0=0x0, dwReserved1=0x0, cFileName="RJS.jpg", cAlternateFileName="")) returned 1 [0080.836] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5f53650, ftCreationTime.dwHighDateTime=0x1d5db84, ftLastAccessTime.dwLowDateTime=0xcbcb4680, ftLastAccessTime.dwHighDateTime=0x1d5e670, ftLastWriteTime.dwLowDateTime=0xcbcb4680, ftLastWriteTime.dwHighDateTime=0x1d5e670, nFileSizeHigh=0x0, nFileSizeLow=0x6f42, dwReserved0=0x0, dwReserved1=0x0, cFileName="rKG_ 4pKufjKiSJ3ZyM.png", cAlternateFileName="RKG_4P~1.PNG")) returned 1 [0080.836] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6336f0, ftCreationTime.dwHighDateTime=0x1d5e098, ftLastAccessTime.dwLowDateTime=0x2e9e8fb0, ftLastAccessTime.dwHighDateTime=0x1d5e577, ftLastWriteTime.dwLowDateTime=0x2e9e8fb0, ftLastWriteTime.dwHighDateTime=0x1d5e577, nFileSizeHigh=0x0, nFileSizeLow=0x7743, dwReserved0=0x0, dwReserved1=0x0, cFileName="s38yY 7dCzHMGxTR.png", cAlternateFileName="S38YY7~1.PNG")) returned 1 [0080.836] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59c462a0, ftCreationTime.dwHighDateTime=0x1d5e130, ftLastAccessTime.dwLowDateTime=0x763fcab0, ftLastAccessTime.dwHighDateTime=0x1d5e279, ftLastWriteTime.dwLowDateTime=0x763fcab0, ftLastWriteTime.dwHighDateTime=0x1d5e279, nFileSizeHigh=0x0, nFileSizeLow=0x4983, dwReserved0=0x0, dwReserved1=0x0, cFileName="SuTjmQruPj.jpg", cAlternateFileName="SUTJMQ~1.JPG")) returned 1 [0080.836] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11124f90, ftCreationTime.dwHighDateTime=0x1d5d988, ftLastAccessTime.dwLowDateTime=0x4090d960, ftLastAccessTime.dwHighDateTime=0x1d5e1e6, ftLastWriteTime.dwLowDateTime=0x4090d960, ftLastWriteTime.dwHighDateTime=0x1d5e1e6, nFileSizeHigh=0x0, nFileSizeLow=0x17685, dwReserved0=0x0, dwReserved1=0x0, cFileName="U1YuAXT.jpg", cAlternateFileName="")) returned 1 [0080.837] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fcf34a0, ftCreationTime.dwHighDateTime=0x1d5ddbb, ftLastAccessTime.dwLowDateTime=0x7bbb8260, ftLastAccessTime.dwHighDateTime=0x1d5dd86, ftLastWriteTime.dwLowDateTime=0x7bbb8260, ftLastWriteTime.dwHighDateTime=0x1d5dd86, nFileSizeHigh=0x0, nFileSizeLow=0x51a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="uer47nTFIa.bmp", cAlternateFileName="UER47N~1.BMP")) returned 1 [0080.837] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc38a18f0, ftCreationTime.dwHighDateTime=0x1d5e16d, ftLastAccessTime.dwLowDateTime=0x72a81190, ftLastAccessTime.dwHighDateTime=0x1d5e153, ftLastWriteTime.dwLowDateTime=0x72a81190, ftLastWriteTime.dwHighDateTime=0x1d5e153, nFileSizeHigh=0x0, nFileSizeLow=0xd091, dwReserved0=0x0, dwReserved1=0x0, cFileName="UZnU.bmp", cAlternateFileName="")) returned 1 [0080.837] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82609b00, ftCreationTime.dwHighDateTime=0x1d5d9a8, ftLastAccessTime.dwLowDateTime=0x8496b2f0, ftLastAccessTime.dwHighDateTime=0x1d5e7a0, ftLastWriteTime.dwLowDateTime=0x8496b2f0, ftLastWriteTime.dwHighDateTime=0x1d5e7a0, nFileSizeHigh=0x0, nFileSizeLow=0xc786, dwReserved0=0x0, dwReserved1=0x0, cFileName="V54n7rzEj4K.png", cAlternateFileName="V54N7R~1.PNG")) returned 1 [0080.837] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49df51b0, ftCreationTime.dwHighDateTime=0x1d5e6bc, ftLastAccessTime.dwLowDateTime=0x7cbb8730, ftLastAccessTime.dwHighDateTime=0x1d5e0fd, ftLastWriteTime.dwLowDateTime=0x7cbb8730, ftLastWriteTime.dwHighDateTime=0x1d5e0fd, nFileSizeHigh=0x0, nFileSizeLow=0x1730b, dwReserved0=0x0, dwReserved1=0x0, cFileName="VCc5.bmp", cAlternateFileName="")) returned 1 [0080.838] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x168b8d0, ftCreationTime.dwHighDateTime=0x1d5e69a, ftLastAccessTime.dwLowDateTime=0xfd62eb70, ftLastAccessTime.dwHighDateTime=0x1d5dc3a, ftLastWriteTime.dwLowDateTime=0xfd62eb70, ftLastWriteTime.dwHighDateTime=0x1d5dc3a, nFileSizeHigh=0x0, nFileSizeLow=0x556e, dwReserved0=0x0, dwReserved1=0x0, cFileName="vQQ2D-7N55c.gif", cAlternateFileName="VQQ2D-~1.GIF")) returned 1 [0080.838] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f45030, ftCreationTime.dwHighDateTime=0x1d5dc39, ftLastAccessTime.dwLowDateTime=0x16bb1f90, ftLastAccessTime.dwHighDateTime=0x1d5e3dc, ftLastWriteTime.dwLowDateTime=0x16bb1f90, ftLastWriteTime.dwHighDateTime=0x1d5e3dc, nFileSizeHigh=0x0, nFileSizeLow=0xf92e, dwReserved0=0x0, dwReserved1=0x0, cFileName="VRprTu8a1KFGc5YDi.bmp", cAlternateFileName="VRPRTU~1.BMP")) returned 1 [0080.838] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4aca9d0, ftCreationTime.dwHighDateTime=0x1d5dda5, ftLastAccessTime.dwLowDateTime=0x2d25a920, ftLastAccessTime.dwHighDateTime=0x1d5de15, ftLastWriteTime.dwLowDateTime=0x2d25a920, ftLastWriteTime.dwHighDateTime=0x1d5de15, nFileSizeHigh=0x0, nFileSizeLow=0x189dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="YmHktCzsi7P.gif", cAlternateFileName="YMHKTC~1.GIF")) returned 1 [0080.838] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc49db5f0, ftCreationTime.dwHighDateTime=0x1d5e1e8, ftLastAccessTime.dwLowDateTime=0x54e76bb0, ftLastAccessTime.dwHighDateTime=0x1d5e130, ftLastWriteTime.dwLowDateTime=0x54e76bb0, ftLastWriteTime.dwHighDateTime=0x1d5e130, nFileSizeHigh=0x0, nFileSizeLow=0xf92f, dwReserved0=0x0, dwReserved1=0x0, cFileName="YZvLg50Le5JU2L12Ab.gif", cAlternateFileName="YZVLG5~1.GIF")) returned 1 [0080.838] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4c98020, ftCreationTime.dwHighDateTime=0x1d5d9da, ftLastAccessTime.dwLowDateTime=0xa0be3840, ftLastAccessTime.dwHighDateTime=0x1d5e34f, ftLastWriteTime.dwLowDateTime=0xa0be3840, ftLastWriteTime.dwHighDateTime=0x1d5e34f, nFileSizeHigh=0x0, nFileSizeLow=0x7766, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZxOBzF3IrR49Erv.gif", cAlternateFileName="ZXOBZF~1.GIF")) returned 1 [0080.839] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4c98020, ftCreationTime.dwHighDateTime=0x1d5d9da, ftLastAccessTime.dwLowDateTime=0xa0be3840, ftLastAccessTime.dwHighDateTime=0x1d5e34f, ftLastWriteTime.dwLowDateTime=0xa0be3840, ftLastWriteTime.dwHighDateTime=0x1d5e34f, nFileSizeHigh=0x0, nFileSizeLow=0x7766, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZxOBzF3IrR49Erv.gif", cAlternateFileName="ZXOBZF~1.GIF")) returned 0 [0080.839] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0080.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf0c0) returned 1 [0080.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf0cc) returned 1 [0080.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf100) returned 1 [0080.839] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", nBufferLength=0x105, lpBuffer=0x5bbec08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", lpFilePart=0x0) returned 0x26 [0080.839] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", nBufferLength=0x105, lpBuffer=0x5bbebdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", lpFilePart=0x0) returned 0x27 [0080.839] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*", lpFindFileData=0x5bbee28 | out: lpFindFileData=0x5bbee28*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdbf84100, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf84100, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0080.840] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdbf84100, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf84100, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.840] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c28eb0, ftCreationTime.dwHighDateTime=0x1d5dafe, ftLastAccessTime.dwLowDateTime=0xe512e770, ftLastAccessTime.dwHighDateTime=0x1d5dc0b, ftLastWriteTime.dwLowDateTime=0xe512e770, ftLastWriteTime.dwHighDateTime=0x1d5dc0b, nFileSizeHigh=0x0, nFileSizeLow=0x89a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="-BRKLxTrDQf7q1zC--.bmp", cAlternateFileName="-BRKLX~1.BMP")) returned 1 [0080.840] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf9c5bb0, ftCreationTime.dwHighDateTime=0x1d5d9b2, ftLastAccessTime.dwLowDateTime=0x8d7bb590, ftLastAccessTime.dwHighDateTime=0x1d5da63, ftLastWriteTime.dwLowDateTime=0x8d7bb590, ftLastWriteTime.dwHighDateTime=0x1d5da63, nFileSizeHigh=0x0, nFileSizeLow=0x1639f, dwReserved0=0x0, dwReserved1=0x0, cFileName="3fOOr-tj.gif", cAlternateFileName="")) returned 1 [0080.840] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d250da0, ftCreationTime.dwHighDateTime=0x1d5df45, ftLastAccessTime.dwLowDateTime=0x333857f0, ftLastAccessTime.dwHighDateTime=0x1d5de78, ftLastWriteTime.dwLowDateTime=0x333857f0, ftLastWriteTime.dwHighDateTime=0x1d5de78, nFileSizeHigh=0x0, nFileSizeLow=0x91b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="71MI9ndSEEU5tAC.bmp", cAlternateFileName="71MI9N~1.BMP")) returned 1 [0080.841] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cc0f880, ftCreationTime.dwHighDateTime=0x1d5dbbf, ftLastAccessTime.dwLowDateTime=0x2d1ca300, ftLastAccessTime.dwHighDateTime=0x1d5d9e4, ftLastWriteTime.dwLowDateTime=0x2d1ca300, ftLastWriteTime.dwHighDateTime=0x1d5d9e4, nFileSizeHigh=0x0, nFileSizeLow=0x706d, dwReserved0=0x0, dwReserved1=0x0, cFileName="A5lN-_K.gif", cAlternateFileName="")) returned 1 [0080.841] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e410cd0, ftCreationTime.dwHighDateTime=0x1d5de52, ftLastAccessTime.dwLowDateTime=0xee400e40, ftLastAccessTime.dwHighDateTime=0x1d5d8a0, ftLastWriteTime.dwLowDateTime=0xee400e40, ftLastWriteTime.dwHighDateTime=0x1d5d8a0, nFileSizeHigh=0x0, nFileSizeLow=0x10654, dwReserved0=0x0, dwReserved1=0x0, cFileName="aD7vAKGbt-teGRGOf.bmp", cAlternateFileName="AD7VAK~1.BMP")) returned 1 [0080.841] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce82910, ftCreationTime.dwHighDateTime=0x1d5dbb8, ftLastAccessTime.dwLowDateTime=0x1fe522b0, ftLastAccessTime.dwHighDateTime=0x1d5df6c, ftLastWriteTime.dwLowDateTime=0x1fe522b0, ftLastWriteTime.dwHighDateTime=0x1d5df6c, nFileSizeHigh=0x0, nFileSizeLow=0xabad, dwReserved0=0x0, dwReserved1=0x0, cFileName="aVBuptDTVXCYrU.gif", cAlternateFileName="AVBUPT~1.GIF")) returned 1 [0080.841] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62eee2f0, ftCreationTime.dwHighDateTime=0x1d5e62c, ftLastAccessTime.dwLowDateTime=0xd50dd660, ftLastAccessTime.dwHighDateTime=0x1d5e600, ftLastWriteTime.dwLowDateTime=0xd50dd660, ftLastWriteTime.dwHighDateTime=0x1d5e600, nFileSizeHigh=0x0, nFileSizeLow=0xf955, dwReserved0=0x0, dwReserved1=0x0, cFileName="BGBHbSpDEyu-XJdGi6.jpg", cAlternateFileName="BGBHBS~1.JPG")) returned 1 [0080.841] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x436e79b0, ftCreationTime.dwHighDateTime=0x1d5da9a, ftLastAccessTime.dwLowDateTime=0xda136b60, ftLastAccessTime.dwHighDateTime=0x1d5dde6, ftLastWriteTime.dwLowDateTime=0xda136b60, ftLastWriteTime.dwHighDateTime=0x1d5dde6, nFileSizeHigh=0x0, nFileSizeLow=0xc7ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="c2i9T9ZdZ0iB.bmp", cAlternateFileName="C2I9T9~1.BMP")) returned 1 [0080.842] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a0d6c70, ftCreationTime.dwHighDateTime=0x1d5db58, ftLastAccessTime.dwLowDateTime=0xbe041b80, ftLastAccessTime.dwHighDateTime=0x1d5e675, ftLastWriteTime.dwLowDateTime=0xbe041b80, ftLastWriteTime.dwHighDateTime=0x1d5e675, nFileSizeHigh=0x0, nFileSizeLow=0x8b5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="cmZkXcJ0NAd803xVvT.jpg", cAlternateFileName="CMZKXC~1.JPG")) returned 1 [0080.842] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x390a43d0, ftCreationTime.dwHighDateTime=0x1d5dd94, ftLastAccessTime.dwLowDateTime=0x89c84590, ftLastAccessTime.dwHighDateTime=0x1d5d9d6, ftLastWriteTime.dwLowDateTime=0x89c84590, ftLastWriteTime.dwHighDateTime=0x1d5d9d6, nFileSizeHigh=0x0, nFileSizeLow=0xa9ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="CZ1cCRQ_KLTfRI8wQoMn.png", cAlternateFileName="CZ1CCR~1.PNG")) returned 1 [0080.842] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31d69690, ftCreationTime.dwHighDateTime=0x1d5e050, ftLastAccessTime.dwLowDateTime=0xad43a4f0, ftLastAccessTime.dwHighDateTime=0x1d5e3cd, ftLastWriteTime.dwLowDateTime=0xad43a4f0, ftLastWriteTime.dwHighDateTime=0x1d5e3cd, nFileSizeHigh=0x0, nFileSizeLow=0x25fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="CZbr9DWttkzQtmagXJ-z.gif", cAlternateFileName="CZBR9D~1.GIF")) returned 1 [0080.842] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7710670, ftCreationTime.dwHighDateTime=0x1d5d9e7, ftLastAccessTime.dwLowDateTime=0x5bcb95a0, ftLastAccessTime.dwHighDateTime=0x1d5e554, ftLastWriteTime.dwLowDateTime=0x5bcb95a0, ftLastWriteTime.dwHighDateTime=0x1d5e554, nFileSizeHigh=0x0, nFileSizeLow=0x1eef, dwReserved0=0x0, dwReserved1=0x0, cFileName="ddr1lcuPdatwN3L2.bmp", cAlternateFileName="DDR1LC~1.BMP")) returned 1 [0080.842] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0080.842] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f20cbe0, ftCreationTime.dwHighDateTime=0x1d5df45, ftLastAccessTime.dwLowDateTime=0xf86dd2c0, ftLastAccessTime.dwHighDateTime=0x1d5dfd6, ftLastWriteTime.dwLowDateTime=0xf86dd2c0, ftLastWriteTime.dwHighDateTime=0x1d5dfd6, nFileSizeHigh=0x0, nFileSizeLow=0x484b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ESRCIbGBEY9iOjypF4Be.gif", cAlternateFileName="ESRCIB~1.GIF")) returned 1 [0080.843] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34b9e9a0, ftCreationTime.dwHighDateTime=0x1d5e6a1, ftLastAccessTime.dwLowDateTime=0x8a30f8f0, ftLastAccessTime.dwHighDateTime=0x1d5e6fc, ftLastWriteTime.dwLowDateTime=0x8a30f8f0, ftLastWriteTime.dwHighDateTime=0x1d5e6fc, nFileSizeHigh=0x0, nFileSizeLow=0x1298f, dwReserved0=0x0, dwReserved1=0x0, cFileName="fKjFMjXeY69.jpg", cAlternateFileName="FKJFMJ~1.JPG")) returned 1 [0080.843] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24384df0, ftCreationTime.dwHighDateTime=0x1d5e021, ftLastAccessTime.dwLowDateTime=0xca923c60, ftLastAccessTime.dwHighDateTime=0x1d5e693, ftLastWriteTime.dwLowDateTime=0xca923c60, ftLastWriteTime.dwHighDateTime=0x1d5e693, nFileSizeHigh=0x0, nFileSizeLow=0x5de7, dwReserved0=0x0, dwReserved1=0x0, cFileName="fYPmZ4LF3.jpg", cAlternateFileName="FYPMZ4~1.JPG")) returned 1 [0080.843] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99472f40, ftCreationTime.dwHighDateTime=0x1d5e1bf, ftLastAccessTime.dwLowDateTime=0xc5385bc0, ftLastAccessTime.dwHighDateTime=0x1d5e72c, ftLastWriteTime.dwLowDateTime=0xc5385bc0, ftLastWriteTime.dwHighDateTime=0x1d5e72c, nFileSizeHigh=0x0, nFileSizeLow=0x17bd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="g2UGB7FSLw09NkiqQUi.png", cAlternateFileName="G2UGB7~1.PNG")) returned 1 [0080.843] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92bd6600, ftCreationTime.dwHighDateTime=0x1d5d998, ftLastAccessTime.dwLowDateTime=0x9878660, ftLastAccessTime.dwHighDateTime=0x1d5e670, ftLastWriteTime.dwLowDateTime=0x9878660, ftLastWriteTime.dwHighDateTime=0x1d5e670, nFileSizeHigh=0x0, nFileSizeLow=0x12bdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="gn-ZjDb.png", cAlternateFileName="")) returned 1 [0080.843] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7f32b90, ftCreationTime.dwHighDateTime=0x1d5e0c1, ftLastAccessTime.dwLowDateTime=0xa6232e70, ftLastAccessTime.dwHighDateTime=0x1d5e350, ftLastWriteTime.dwLowDateTime=0xa6232e70, ftLastWriteTime.dwHighDateTime=0x1d5e350, nFileSizeHigh=0x0, nFileSizeLow=0x794d, dwReserved0=0x0, dwReserved1=0x0, cFileName="GxPk.png", cAlternateFileName="")) returned 1 [0080.843] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90546e50, ftCreationTime.dwHighDateTime=0x1d5df14, ftLastAccessTime.dwLowDateTime=0x5c2ac20, ftLastAccessTime.dwHighDateTime=0x1d5d8fc, ftLastWriteTime.dwLowDateTime=0x5c2ac20, ftLastWriteTime.dwHighDateTime=0x1d5d8fc, nFileSizeHigh=0x0, nFileSizeLow=0x27b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="HRpZ-PAv6bn.gif", cAlternateFileName="HRPZ-P~1.GIF")) returned 1 [0080.844] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f451b80, ftCreationTime.dwHighDateTime=0x1d5dda5, ftLastAccessTime.dwLowDateTime=0x57544d70, ftLastAccessTime.dwHighDateTime=0x1d5e0b6, ftLastWriteTime.dwLowDateTime=0x57544d70, ftLastWriteTime.dwHighDateTime=0x1d5e0b6, nFileSizeHigh=0x0, nFileSizeLow=0x67f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="hXBfoDBSVT4yoHp.bmp", cAlternateFileName="HXBFOD~1.BMP")) returned 1 [0080.844] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c0621a0, ftCreationTime.dwHighDateTime=0x1d5d7ce, ftLastAccessTime.dwLowDateTime=0xc9c95ae0, ftLastAccessTime.dwHighDateTime=0x1d5de3f, ftLastWriteTime.dwLowDateTime=0xc9c95ae0, ftLastWriteTime.dwHighDateTime=0x1d5de3f, nFileSizeHigh=0x0, nFileSizeLow=0x12108, dwReserved0=0x0, dwReserved1=0x0, cFileName="HxxMXX3HX.jpg", cAlternateFileName="HXXMXX~1.JPG")) returned 1 [0080.844] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24316dc0, ftCreationTime.dwHighDateTime=0x1d5db0b, ftLastAccessTime.dwLowDateTime=0x95b35a0, ftLastAccessTime.dwHighDateTime=0x1d5db40, ftLastWriteTime.dwLowDateTime=0x95b35a0, ftLastWriteTime.dwHighDateTime=0x1d5db40, nFileSizeHigh=0x0, nFileSizeLow=0xce7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ixfl.png", cAlternateFileName="")) returned 1 [0080.844] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7cb3a40, ftCreationTime.dwHighDateTime=0x1d5db06, ftLastAccessTime.dwLowDateTime=0x71cc3e30, ftLastAccessTime.dwHighDateTime=0x1d5e6fe, ftLastWriteTime.dwLowDateTime=0x71cc3e30, ftLastWriteTime.dwHighDateTime=0x1d5e6fe, nFileSizeHigh=0x0, nFileSizeLow=0xf6ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="jeDUyPaiwFP-.bmp", cAlternateFileName="JEDUYP~1.BMP")) returned 1 [0080.844] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19801fa0, ftCreationTime.dwHighDateTime=0x1d5dd10, ftLastAccessTime.dwLowDateTime=0xabade880, ftLastAccessTime.dwHighDateTime=0x1d5dab3, ftLastWriteTime.dwLowDateTime=0xabade880, ftLastWriteTime.dwHighDateTime=0x1d5dab3, nFileSizeHigh=0x0, nFileSizeLow=0xd492, dwReserved0=0x0, dwReserved1=0x0, cFileName="lXsi6Keyn-.jpg", cAlternateFileName="LXSI6K~1.JPG")) returned 1 [0080.844] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77368240, ftCreationTime.dwHighDateTime=0x1d5e172, ftLastAccessTime.dwLowDateTime=0xd76983b0, ftLastAccessTime.dwHighDateTime=0x1d5dfec, ftLastWriteTime.dwLowDateTime=0xd76983b0, ftLastWriteTime.dwHighDateTime=0x1d5dfec, nFileSizeHigh=0x0, nFileSizeLow=0x5ea5, dwReserved0=0x0, dwReserved1=0x0, cFileName="mm358wJa6Q8te1kBB0.bmp", cAlternateFileName="MM358W~1.BMP")) returned 1 [0080.844] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37790040, ftCreationTime.dwHighDateTime=0x1d5da85, ftLastAccessTime.dwLowDateTime=0xb43945e0, ftLastAccessTime.dwHighDateTime=0x1d5deef, ftLastWriteTime.dwLowDateTime=0xb43945e0, ftLastWriteTime.dwHighDateTime=0x1d5deef, nFileSizeHigh=0x0, nFileSizeLow=0xf117, dwReserved0=0x0, dwReserved1=0x0, cFileName="oSsCw2.bmp", cAlternateFileName="")) returned 1 [0080.845] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e55d70, ftCreationTime.dwHighDateTime=0x1d5e37a, ftLastAccessTime.dwLowDateTime=0x750cfb50, ftLastAccessTime.dwHighDateTime=0x1d5e30e, ftLastWriteTime.dwLowDateTime=0x750cfb50, ftLastWriteTime.dwHighDateTime=0x1d5e30e, nFileSizeHigh=0x0, nFileSizeLow=0x8c9d, dwReserved0=0x0, dwReserved1=0x0, cFileName="RJS.jpg", cAlternateFileName="")) returned 1 [0080.845] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5f53650, ftCreationTime.dwHighDateTime=0x1d5db84, ftLastAccessTime.dwLowDateTime=0xcbcb4680, ftLastAccessTime.dwHighDateTime=0x1d5e670, ftLastWriteTime.dwLowDateTime=0xcbcb4680, ftLastWriteTime.dwHighDateTime=0x1d5e670, nFileSizeHigh=0x0, nFileSizeLow=0x6f42, dwReserved0=0x0, dwReserved1=0x0, cFileName="rKG_ 4pKufjKiSJ3ZyM.png", cAlternateFileName="RKG_4P~1.PNG")) returned 1 [0080.845] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6336f0, ftCreationTime.dwHighDateTime=0x1d5e098, ftLastAccessTime.dwLowDateTime=0x2e9e8fb0, ftLastAccessTime.dwHighDateTime=0x1d5e577, ftLastWriteTime.dwLowDateTime=0x2e9e8fb0, ftLastWriteTime.dwHighDateTime=0x1d5e577, nFileSizeHigh=0x0, nFileSizeLow=0x7743, dwReserved0=0x0, dwReserved1=0x0, cFileName="s38yY 7dCzHMGxTR.png", cAlternateFileName="S38YY7~1.PNG")) returned 1 [0080.845] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59c462a0, ftCreationTime.dwHighDateTime=0x1d5e130, ftLastAccessTime.dwLowDateTime=0x763fcab0, ftLastAccessTime.dwHighDateTime=0x1d5e279, ftLastWriteTime.dwLowDateTime=0x763fcab0, ftLastWriteTime.dwHighDateTime=0x1d5e279, nFileSizeHigh=0x0, nFileSizeLow=0x4983, dwReserved0=0x0, dwReserved1=0x0, cFileName="SuTjmQruPj.jpg", cAlternateFileName="SUTJMQ~1.JPG")) returned 1 [0080.845] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11124f90, ftCreationTime.dwHighDateTime=0x1d5d988, ftLastAccessTime.dwLowDateTime=0x4090d960, ftLastAccessTime.dwHighDateTime=0x1d5e1e6, ftLastWriteTime.dwLowDateTime=0x4090d960, ftLastWriteTime.dwHighDateTime=0x1d5e1e6, nFileSizeHigh=0x0, nFileSizeLow=0x17685, dwReserved0=0x0, dwReserved1=0x0, cFileName="U1YuAXT.jpg", cAlternateFileName="")) returned 1 [0080.845] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fcf34a0, ftCreationTime.dwHighDateTime=0x1d5ddbb, ftLastAccessTime.dwLowDateTime=0x7bbb8260, ftLastAccessTime.dwHighDateTime=0x1d5dd86, ftLastWriteTime.dwLowDateTime=0x7bbb8260, ftLastWriteTime.dwHighDateTime=0x1d5dd86, nFileSizeHigh=0x0, nFileSizeLow=0x51a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="uer47nTFIa.bmp", cAlternateFileName="UER47N~1.BMP")) returned 1 [0080.846] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc38a18f0, ftCreationTime.dwHighDateTime=0x1d5e16d, ftLastAccessTime.dwLowDateTime=0x72a81190, ftLastAccessTime.dwHighDateTime=0x1d5e153, ftLastWriteTime.dwLowDateTime=0x72a81190, ftLastWriteTime.dwHighDateTime=0x1d5e153, nFileSizeHigh=0x0, nFileSizeLow=0xd091, dwReserved0=0x0, dwReserved1=0x0, cFileName="UZnU.bmp", cAlternateFileName="")) returned 1 [0080.846] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82609b00, ftCreationTime.dwHighDateTime=0x1d5d9a8, ftLastAccessTime.dwLowDateTime=0x8496b2f0, ftLastAccessTime.dwHighDateTime=0x1d5e7a0, ftLastWriteTime.dwLowDateTime=0x8496b2f0, ftLastWriteTime.dwHighDateTime=0x1d5e7a0, nFileSizeHigh=0x0, nFileSizeLow=0xc786, dwReserved0=0x0, dwReserved1=0x0, cFileName="V54n7rzEj4K.png", cAlternateFileName="V54N7R~1.PNG")) returned 1 [0080.846] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49df51b0, ftCreationTime.dwHighDateTime=0x1d5e6bc, ftLastAccessTime.dwLowDateTime=0x7cbb8730, ftLastAccessTime.dwHighDateTime=0x1d5e0fd, ftLastWriteTime.dwLowDateTime=0x7cbb8730, ftLastWriteTime.dwHighDateTime=0x1d5e0fd, nFileSizeHigh=0x0, nFileSizeLow=0x1730b, dwReserved0=0x0, dwReserved1=0x0, cFileName="VCc5.bmp", cAlternateFileName="")) returned 1 [0080.846] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x168b8d0, ftCreationTime.dwHighDateTime=0x1d5e69a, ftLastAccessTime.dwLowDateTime=0xfd62eb70, ftLastAccessTime.dwHighDateTime=0x1d5dc3a, ftLastWriteTime.dwLowDateTime=0xfd62eb70, ftLastWriteTime.dwHighDateTime=0x1d5dc3a, nFileSizeHigh=0x0, nFileSizeLow=0x556e, dwReserved0=0x0, dwReserved1=0x0, cFileName="vQQ2D-7N55c.gif", cAlternateFileName="VQQ2D-~1.GIF")) returned 1 [0080.846] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f45030, ftCreationTime.dwHighDateTime=0x1d5dc39, ftLastAccessTime.dwLowDateTime=0x16bb1f90, ftLastAccessTime.dwHighDateTime=0x1d5e3dc, ftLastWriteTime.dwLowDateTime=0x16bb1f90, ftLastWriteTime.dwHighDateTime=0x1d5e3dc, nFileSizeHigh=0x0, nFileSizeLow=0xf92e, dwReserved0=0x0, dwReserved1=0x0, cFileName="VRprTu8a1KFGc5YDi.bmp", cAlternateFileName="VRPRTU~1.BMP")) returned 1 [0080.846] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4aca9d0, ftCreationTime.dwHighDateTime=0x1d5dda5, ftLastAccessTime.dwLowDateTime=0x2d25a920, ftLastAccessTime.dwHighDateTime=0x1d5de15, ftLastWriteTime.dwLowDateTime=0x2d25a920, ftLastWriteTime.dwHighDateTime=0x1d5de15, nFileSizeHigh=0x0, nFileSizeLow=0x189dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="YmHktCzsi7P.gif", cAlternateFileName="YMHKTC~1.GIF")) returned 1 [0080.846] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc49db5f0, ftCreationTime.dwHighDateTime=0x1d5e1e8, ftLastAccessTime.dwLowDateTime=0x54e76bb0, ftLastAccessTime.dwHighDateTime=0x1d5e130, ftLastWriteTime.dwLowDateTime=0x54e76bb0, ftLastWriteTime.dwHighDateTime=0x1d5e130, nFileSizeHigh=0x0, nFileSizeLow=0xf92f, dwReserved0=0x0, dwReserved1=0x0, cFileName="YZvLg50Le5JU2L12Ab.gif", cAlternateFileName="YZVLG5~1.GIF")) returned 1 [0080.847] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4c98020, ftCreationTime.dwHighDateTime=0x1d5d9da, ftLastAccessTime.dwLowDateTime=0xa0be3840, ftLastAccessTime.dwHighDateTime=0x1d5e34f, ftLastWriteTime.dwLowDateTime=0xa0be3840, ftLastWriteTime.dwHighDateTime=0x1d5e34f, nFileSizeHigh=0x0, nFileSizeLow=0x7766, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZxOBzF3IrR49Erv.gif", cAlternateFileName="ZXOBZF~1.GIF")) returned 1 [0080.847] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0080.847] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0080.847] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf0c0) returned 1 [0080.847] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf0cc) returned 1 [0080.847] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", nBufferLength=0x105, lpBuffer=0x5bbec6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", lpFilePart=0x0) returned 0x26 [0080.847] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x5bbeb0c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0080.848] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Pictures.txt", nBufferLength=0x105, lpBuffer=0x5bbeb20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Pictures.txt", lpFilePart=0x0) returned 0x84 [0080.848] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf014) returned 1 [0080.848] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Pictures.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs\\pictures.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x498 [0080.848] GetFileType (hFile=0x498) returned 0x1 [0080.848] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf010) returned 1 [0080.848] GetFileType (hFile=0x498) returned 0x1 [0080.849] WriteFile (in: hFile=0x498, lpBuffer=0x274134c*, nNumberOfBytesToWrite=0x31f, lpNumberOfBytesWritten=0x5bbf0ac, lpOverlapped=0x0 | out: lpBuffer=0x274134c*, lpNumberOfBytesWritten=0x5bbf0ac*=0x31f, lpOverlapped=0x0) returned 1 [0080.850] CloseHandle (hObject=0x498) returned 1 [0080.851] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos", nBufferLength=0x105, lpBuffer=0x5bbec38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos", lpFilePart=0x0) returned 0x24 [0080.851] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf094) returned 1 [0080.851] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos"), fInfoLevelId=0x0, lpFileInformation=0x5bbf110 | out: lpFileInformation=0x5bbf110*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdbf11ce0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf11ce0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0080.851] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf090) returned 1 [0080.851] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos", nBufferLength=0x105, lpBuffer=0x5bbec38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos", lpFilePart=0x0) returned 0x24 [0080.851] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf100) returned 1 [0080.851] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos", nBufferLength=0x105, lpBuffer=0x5bbec08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos", lpFilePart=0x0) returned 0x24 [0080.851] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\", nBufferLength=0x105, lpBuffer=0x5bbebdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\", lpFilePart=0x0) returned 0x25 [0080.851] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\*", lpFindFileData=0x5bbee28 | out: lpFindFileData=0x5bbee28*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdbf11ce0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf11ce0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0080.851] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdbf11ce0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf11ce0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.851] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8bc769b0, ftCreationTime.dwHighDateTime=0x1d5e6f7, ftLastAccessTime.dwLowDateTime=0xdaac6e50, ftLastAccessTime.dwHighDateTime=0x1d5db39, ftLastWriteTime.dwLowDateTime=0xdaac6e50, ftLastWriteTime.dwHighDateTime=0x1d5db39, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1Xq74mC5Z6A7", cAlternateFileName="1XQ74M~1")) returned 1 [0080.852] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f0f6890, ftCreationTime.dwHighDateTime=0x1d5de6e, ftLastAccessTime.dwLowDateTime=0xc0915950, ftLastAccessTime.dwHighDateTime=0x1d5e0d3, ftLastWriteTime.dwLowDateTime=0xc0915950, ftLastWriteTime.dwHighDateTime=0x1d5e0d3, nFileSizeHigh=0x0, nFileSizeLow=0xa1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="AKpjDRBtV4E.flv", cAlternateFileName="AKPJDR~1.FLV")) returned 1 [0080.852] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0080.852] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x370dc2f0, ftCreationTime.dwHighDateTime=0x1d5e136, ftLastAccessTime.dwLowDateTime=0x6c325100, ftLastAccessTime.dwHighDateTime=0x1d5d9e6, ftLastWriteTime.dwLowDateTime=0x6c325100, ftLastWriteTime.dwHighDateTime=0x1d5d9e6, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="iz6YTcyqH6vys1VH.mp4", cAlternateFileName="IZ6YTC~1.MP4")) returned 1 [0080.852] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb66bf550, ftCreationTime.dwHighDateTime=0x1d5dde7, ftLastAccessTime.dwLowDateTime=0xb5e8c0d0, ftLastAccessTime.dwHighDateTime=0x1d5daa0, ftLastWriteTime.dwLowDateTime=0xb5e8c0d0, ftLastWriteTime.dwHighDateTime=0x1d5daa0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sUB5", cAlternateFileName="")) returned 1 [0080.852] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5e489d0, ftCreationTime.dwHighDateTime=0x1d5e6a8, ftLastAccessTime.dwLowDateTime=0x5db58210, ftLastAccessTime.dwHighDateTime=0x1d5e3e5, ftLastWriteTime.dwLowDateTime=0x5db58210, ftLastWriteTime.dwHighDateTime=0x1d5e3e5, nFileSizeHigh=0x0, nFileSizeLow=0x4735, dwReserved0=0x0, dwReserved1=0x0, cFileName="t1Wr.flv", cAlternateFileName="")) returned 1 [0080.852] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67c14b80, ftCreationTime.dwHighDateTime=0x1d5dd79, ftLastAccessTime.dwLowDateTime=0x4065cb70, ftLastAccessTime.dwHighDateTime=0x1d5e38b, ftLastWriteTime.dwLowDateTime=0x4065cb70, ftLastWriteTime.dwHighDateTime=0x1d5e38b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="yndAXana", cAlternateFileName="")) returned 1 [0080.853] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0080.853] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0080.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf0c0) returned 1 [0080.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf0cc) returned 1 [0080.853] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\.", nBufferLength=0x105, lpBuffer=0x5bbebc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7", lpFilePart=0x0) returned 0x31 [0080.853] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7", nBufferLength=0x105, lpBuffer=0x5bbebf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7", lpFilePart=0x0) returned 0x31 [0080.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf050) returned 1 [0080.853] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1xq74mc5z6a7"), fInfoLevelId=0x0, lpFileInformation=0x5bbf0cc | out: lpFileInformation=0x5bbf0cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8bc769b0, ftCreationTime.dwHighDateTime=0x1d5e6f7, ftLastAccessTime.dwLowDateTime=0xdaac6e50, ftLastAccessTime.dwHighDateTime=0x1d5db39, ftLastWriteTime.dwLowDateTime=0xdaac6e50, ftLastWriteTime.dwHighDateTime=0x1d5db39, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0080.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf04c) returned 1 [0080.853] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7", nBufferLength=0x105, lpBuffer=0x5bbebf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7", lpFilePart=0x0) returned 0x31 [0080.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf0bc) returned 1 [0080.853] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7", nBufferLength=0x105, lpBuffer=0x5bbebc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7", lpFilePart=0x0) returned 0x31 [0080.853] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\", nBufferLength=0x105, lpBuffer=0x5bbeb98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\", lpFilePart=0x0) returned 0x32 [0080.854] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\*", lpFindFileData=0x5bbede4 | out: lpFindFileData=0x5bbede4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8bc769b0, ftCreationTime.dwHighDateTime=0x1d5e6f7, ftLastAccessTime.dwLowDateTime=0xdaac6e50, ftLastAccessTime.dwHighDateTime=0x1d5db39, ftLastWriteTime.dwLowDateTime=0xdaac6e50, ftLastWriteTime.dwHighDateTime=0x1d5db39, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0080.854] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8bc769b0, ftCreationTime.dwHighDateTime=0x1d5e6f7, ftLastAccessTime.dwLowDateTime=0xdaac6e50, ftLastAccessTime.dwHighDateTime=0x1d5db39, ftLastWriteTime.dwLowDateTime=0xdaac6e50, ftLastWriteTime.dwHighDateTime=0x1d5db39, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.854] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b0a9720, ftCreationTime.dwHighDateTime=0x1d5e290, ftLastAccessTime.dwLowDateTime=0x87d59150, ftLastAccessTime.dwHighDateTime=0x1d5d7e9, ftLastWriteTime.dwLowDateTime=0x87d59150, ftLastWriteTime.dwHighDateTime=0x1d5d7e9, nFileSizeHigh=0x0, nFileSizeLow=0x1268d, dwReserved0=0x0, dwReserved1=0x0, cFileName="bcQJ97S.flv", cAlternateFileName="")) returned 1 [0080.854] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a3c9270, ftCreationTime.dwHighDateTime=0x1d5df2c, ftLastAccessTime.dwLowDateTime=0x5d8bbbc0, ftLastAccessTime.dwHighDateTime=0x1d5dc0a, ftLastWriteTime.dwLowDateTime=0x5d8bbbc0, ftLastWriteTime.dwHighDateTime=0x1d5dc0a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jrlzcN", cAlternateFileName="")) returned 1 [0080.854] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb67e6b20, ftCreationTime.dwHighDateTime=0x1d5e4a6, ftLastAccessTime.dwLowDateTime=0x9f93d270, ftLastAccessTime.dwHighDateTime=0x1d5dad2, ftLastWriteTime.dwLowDateTime=0x9f93d270, ftLastWriteTime.dwHighDateTime=0x1d5dad2, nFileSizeHigh=0x0, nFileSizeLow=0x18ead, dwReserved0=0x0, dwReserved1=0x0, cFileName="VF-j.swf", cAlternateFileName="")) returned 1 [0080.854] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb67e6b20, ftCreationTime.dwHighDateTime=0x1d5e4a6, ftLastAccessTime.dwLowDateTime=0x9f93d270, ftLastAccessTime.dwHighDateTime=0x1d5dad2, ftLastWriteTime.dwLowDateTime=0x9f93d270, ftLastWriteTime.dwHighDateTime=0x1d5dad2, nFileSizeHigh=0x0, nFileSizeLow=0x18ead, dwReserved0=0x0, dwReserved1=0x0, cFileName="VF-j.swf", cAlternateFileName="")) returned 0 [0080.855] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0081.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf07c) returned 1 [0081.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf088) returned 1 [0081.226] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\.", nBufferLength=0x105, lpBuffer=0x5bbeb7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN", lpFilePart=0x0) returned 0x38 [0081.226] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN", nBufferLength=0x105, lpBuffer=0x5bbebb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN", lpFilePart=0x0) returned 0x38 [0081.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf00c) returned 1 [0081.226] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1xq74mc5z6a7\\jrlzcn"), fInfoLevelId=0x0, lpFileInformation=0x5bbf088 | out: lpFileInformation=0x5bbf088*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a3c9270, ftCreationTime.dwHighDateTime=0x1d5df2c, ftLastAccessTime.dwLowDateTime=0x5d8bbbc0, ftLastAccessTime.dwHighDateTime=0x1d5dc0a, ftLastWriteTime.dwLowDateTime=0x5d8bbbc0, ftLastWriteTime.dwHighDateTime=0x1d5dc0a, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0081.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf008) returned 1 [0081.226] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN", nBufferLength=0x105, lpBuffer=0x5bbebb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN", lpFilePart=0x0) returned 0x38 [0081.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf078) returned 1 [0081.226] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN", nBufferLength=0x105, lpBuffer=0x5bbeb80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN", lpFilePart=0x0) returned 0x38 [0081.226] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\", nBufferLength=0x105, lpBuffer=0x5bbeb54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\", lpFilePart=0x0) returned 0x39 [0081.227] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\*", lpFindFileData=0x5bbeda0 | out: lpFindFileData=0x5bbeda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a3c9270, ftCreationTime.dwHighDateTime=0x1d5df2c, ftLastAccessTime.dwLowDateTime=0x5d8bbbc0, ftLastAccessTime.dwHighDateTime=0x1d5dc0a, ftLastWriteTime.dwLowDateTime=0x5d8bbbc0, ftLastWriteTime.dwHighDateTime=0x1d5dc0a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0081.227] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a3c9270, ftCreationTime.dwHighDateTime=0x1d5df2c, ftLastAccessTime.dwLowDateTime=0x5d8bbbc0, ftLastAccessTime.dwHighDateTime=0x1d5dc0a, ftLastWriteTime.dwLowDateTime=0x5d8bbbc0, ftLastWriteTime.dwHighDateTime=0x1d5dc0a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.227] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x470d0b90, ftCreationTime.dwHighDateTime=0x1d5da4a, ftLastAccessTime.dwLowDateTime=0x76263b20, ftLastAccessTime.dwHighDateTime=0x1d5e74e, ftLastWriteTime.dwLowDateTime=0x76263b20, ftLastWriteTime.dwHighDateTime=0x1d5e74e, nFileSizeHigh=0x0, nFileSizeLow=0x835b, dwReserved0=0x0, dwReserved1=0x0, cFileName="fu8Lf11wf4XDZYYv.mp4", cAlternateFileName="FU8LF1~1.MP4")) returned 1 [0081.227] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6adbab0, ftCreationTime.dwHighDateTime=0x1d5e21d, ftLastAccessTime.dwLowDateTime=0x6eceb9f0, ftLastAccessTime.dwHighDateTime=0x1d5e56f, ftLastWriteTime.dwLowDateTime=0x6eceb9f0, ftLastWriteTime.dwHighDateTime=0x1d5e56f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="R5LIt1", cAlternateFileName="")) returned 1 [0081.227] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0081.227] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0081.228] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf038) returned 1 [0081.228] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf044) returned 1 [0081.228] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\.", nBufferLength=0x105, lpBuffer=0x5bbeb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1", lpFilePart=0x0) returned 0x3f [0081.228] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1", nBufferLength=0x105, lpBuffer=0x5bbeb6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1", lpFilePart=0x0) returned 0x3f [0081.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbefc8) returned 1 [0081.228] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1xq74mc5z6a7\\jrlzcn\\r5lit1"), fInfoLevelId=0x0, lpFileInformation=0x5bbf044 | out: lpFileInformation=0x5bbf044*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6adbab0, ftCreationTime.dwHighDateTime=0x1d5e21d, ftLastAccessTime.dwLowDateTime=0x6eceb9f0, ftLastAccessTime.dwHighDateTime=0x1d5e56f, ftLastWriteTime.dwLowDateTime=0x6eceb9f0, ftLastWriteTime.dwHighDateTime=0x1d5e56f, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0081.228] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbefc4) returned 1 [0081.228] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1", nBufferLength=0x105, lpBuffer=0x5bbeb6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1", lpFilePart=0x0) returned 0x3f [0081.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf034) returned 1 [0081.228] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1", nBufferLength=0x105, lpBuffer=0x5bbeb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1", lpFilePart=0x0) returned 0x3f [0081.228] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\", nBufferLength=0x105, lpBuffer=0x5bbeb10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\", lpFilePart=0x0) returned 0x40 [0081.228] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\*", lpFindFileData=0x5bbed5c | out: lpFindFileData=0x5bbed5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6adbab0, ftCreationTime.dwHighDateTime=0x1d5e21d, ftLastAccessTime.dwLowDateTime=0x6eceb9f0, ftLastAccessTime.dwHighDateTime=0x1d5e56f, ftLastWriteTime.dwLowDateTime=0x6eceb9f0, ftLastWriteTime.dwHighDateTime=0x1d5e56f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0081.228] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6adbab0, ftCreationTime.dwHighDateTime=0x1d5e21d, ftLastAccessTime.dwLowDateTime=0x6eceb9f0, ftLastAccessTime.dwHighDateTime=0x1d5e56f, ftLastWriteTime.dwLowDateTime=0x6eceb9f0, ftLastWriteTime.dwHighDateTime=0x1d5e56f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.229] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc724fd30, ftCreationTime.dwHighDateTime=0x1d5db7e, ftLastAccessTime.dwLowDateTime=0x3461be70, ftLastAccessTime.dwHighDateTime=0x1d5dd54, ftLastWriteTime.dwLowDateTime=0x3461be70, ftLastWriteTime.dwHighDateTime=0x1d5dd54, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1EBa", cAlternateFileName="")) returned 1 [0081.229] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62de3da0, ftCreationTime.dwHighDateTime=0x1d5d8e5, ftLastAccessTime.dwLowDateTime=0x51144910, ftLastAccessTime.dwHighDateTime=0x1d5e2f0, ftLastWriteTime.dwLowDateTime=0x51144910, ftLastWriteTime.dwHighDateTime=0x1d5e2f0, nFileSizeHigh=0x0, nFileSizeLow=0x8e9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="5qLoKDmvFfdmoFZ5v.avi", cAlternateFileName="5QLOKD~1.AVI")) returned 1 [0081.230] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6658fe0, ftCreationTime.dwHighDateTime=0x1d5ddc4, ftLastAccessTime.dwLowDateTime=0x24a09d40, ftLastAccessTime.dwHighDateTime=0x1d5d9ed, ftLastWriteTime.dwLowDateTime=0x24a09d40, ftLastWriteTime.dwHighDateTime=0x1d5d9ed, nFileSizeHigh=0x0, nFileSizeLow=0x18134, dwReserved0=0x0, dwReserved1=0x0, cFileName="6DZggA1Ty.flv", cAlternateFileName="6DZGGA~1.FLV")) returned 1 [0081.231] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0457700, ftCreationTime.dwHighDateTime=0x1d5dd3b, ftLastAccessTime.dwLowDateTime=0xede074b0, ftLastAccessTime.dwHighDateTime=0x1d5e149, ftLastWriteTime.dwLowDateTime=0xede074b0, ftLastWriteTime.dwHighDateTime=0x1d5e149, nFileSizeHigh=0x0, nFileSizeLow=0x2bde, dwReserved0=0x0, dwReserved1=0x0, cFileName="j5RouV1j7HnFN.mkv", cAlternateFileName="J5ROUV~1.MKV")) returned 1 [0081.231] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20799b00, ftCreationTime.dwHighDateTime=0x1d5e09f, ftLastAccessTime.dwLowDateTime=0xc78d7f60, ftLastAccessTime.dwHighDateTime=0x1d5e347, ftLastWriteTime.dwLowDateTime=0xc78d7f60, ftLastWriteTime.dwHighDateTime=0x1d5e347, nFileSizeHigh=0x0, nFileSizeLow=0x9f43, dwReserved0=0x0, dwReserved1=0x0, cFileName="NFagidh2b.avi", cAlternateFileName="NFAGID~1.AVI")) returned 1 [0081.231] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x291ccc50, ftCreationTime.dwHighDateTime=0x1d5dd6b, ftLastAccessTime.dwLowDateTime=0x11d73660, ftLastAccessTime.dwHighDateTime=0x1d5e2c1, ftLastWriteTime.dwLowDateTime=0x11d73660, ftLastWriteTime.dwHighDateTime=0x1d5e2c1, nFileSizeHigh=0x0, nFileSizeLow=0xd56c, dwReserved0=0x0, dwReserved1=0x0, cFileName="T9wsPG.mp4", cAlternateFileName="")) returned 1 [0081.231] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x291ccc50, ftCreationTime.dwHighDateTime=0x1d5dd6b, ftLastAccessTime.dwLowDateTime=0x11d73660, ftLastAccessTime.dwHighDateTime=0x1d5e2c1, ftLastWriteTime.dwLowDateTime=0x11d73660, ftLastWriteTime.dwHighDateTime=0x1d5e2c1, nFileSizeHigh=0x0, nFileSizeLow=0xd56c, dwReserved0=0x0, dwReserved1=0x0, cFileName="T9wsPG.mp4", cAlternateFileName="")) returned 0 [0081.231] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0081.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbeff4) returned 1 [0081.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf000) returned 1 [0081.232] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\1EBa\\.", nBufferLength=0x105, lpBuffer=0x5bbeaf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\1EBa", lpFilePart=0x0) returned 0x44 [0081.232] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\1EBa", nBufferLength=0x105, lpBuffer=0x5bbeb28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\1EBa", lpFilePart=0x0) returned 0x44 [0081.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbef84) returned 1 [0081.232] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\1EBa" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1xq74mc5z6a7\\jrlzcn\\r5lit1\\1eba"), fInfoLevelId=0x0, lpFileInformation=0x5bbf000 | out: lpFileInformation=0x5bbf000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc724fd30, ftCreationTime.dwHighDateTime=0x1d5db7e, ftLastAccessTime.dwLowDateTime=0x3461be70, ftLastAccessTime.dwHighDateTime=0x1d5dd54, ftLastWriteTime.dwLowDateTime=0x3461be70, ftLastWriteTime.dwHighDateTime=0x1d5dd54, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0081.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbef80) returned 1 [0081.232] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\1EBa", nBufferLength=0x105, lpBuffer=0x5bbeb28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\1EBa", lpFilePart=0x0) returned 0x44 [0081.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbeff0) returned 1 [0081.232] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\1EBa", nBufferLength=0x105, lpBuffer=0x5bbeaf8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\1EBa", lpFilePart=0x0) returned 0x44 [0081.232] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\1EBa\\", nBufferLength=0x105, lpBuffer=0x5bbeacc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\1EBa\\", lpFilePart=0x0) returned 0x45 [0081.232] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\1EBa\\*", lpFindFileData=0x5bbed18 | out: lpFindFileData=0x5bbed18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc724fd30, ftCreationTime.dwHighDateTime=0x1d5db7e, ftLastAccessTime.dwLowDateTime=0x3461be70, ftLastAccessTime.dwHighDateTime=0x1d5dd54, ftLastWriteTime.dwLowDateTime=0x3461be70, ftLastWriteTime.dwHighDateTime=0x1d5dd54, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0081.233] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed28 | out: lpFindFileData=0x5bbed28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc724fd30, ftCreationTime.dwHighDateTime=0x1d5db7e, ftLastAccessTime.dwLowDateTime=0x3461be70, ftLastAccessTime.dwHighDateTime=0x1d5dd54, ftLastWriteTime.dwLowDateTime=0x3461be70, ftLastWriteTime.dwHighDateTime=0x1d5dd54, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.233] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed28 | out: lpFindFileData=0x5bbed28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5c45600, ftCreationTime.dwHighDateTime=0x1d5e2c2, ftLastAccessTime.dwLowDateTime=0x297c3500, ftLastAccessTime.dwHighDateTime=0x1d5e18a, ftLastWriteTime.dwLowDateTime=0x297c3500, ftLastWriteTime.dwHighDateTime=0x1d5e18a, nFileSizeHigh=0x0, nFileSizeLow=0x13a12, dwReserved0=0x0, dwReserved1=0x0, cFileName="e PdeInE20xW S.mkv", cAlternateFileName="EPDEIN~1.MKV")) returned 1 [0081.233] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed28 | out: lpFindFileData=0x5bbed28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5c45600, ftCreationTime.dwHighDateTime=0x1d5e2c2, ftLastAccessTime.dwLowDateTime=0x297c3500, ftLastAccessTime.dwHighDateTime=0x1d5e18a, ftLastWriteTime.dwLowDateTime=0x297c3500, ftLastWriteTime.dwHighDateTime=0x1d5e18a, nFileSizeHigh=0x0, nFileSizeLow=0x13a12, dwReserved0=0x0, dwReserved1=0x0, cFileName="e PdeInE20xW S.mkv", cAlternateFileName="EPDEIN~1.MKV")) returned 0 [0081.233] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0081.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbefb0) returned 1 [0081.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbefbc) returned 1 [0081.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbeff0) returned 1 [0081.233] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\1EBa", nBufferLength=0x105, lpBuffer=0x5bbeaf8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\1EBa", lpFilePart=0x0) returned 0x44 [0081.234] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\1EBa\\", nBufferLength=0x105, lpBuffer=0x5bbeacc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\1EBa\\", lpFilePart=0x0) returned 0x45 [0081.234] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\1EBa\\*", lpFindFileData=0x5bbed18 | out: lpFindFileData=0x5bbed18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc724fd30, ftCreationTime.dwHighDateTime=0x1d5db7e, ftLastAccessTime.dwLowDateTime=0x3461be70, ftLastAccessTime.dwHighDateTime=0x1d5dd54, ftLastWriteTime.dwLowDateTime=0x3461be70, ftLastWriteTime.dwHighDateTime=0x1d5dd54, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0081.234] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed28 | out: lpFindFileData=0x5bbed28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc724fd30, ftCreationTime.dwHighDateTime=0x1d5db7e, ftLastAccessTime.dwLowDateTime=0x3461be70, ftLastAccessTime.dwHighDateTime=0x1d5dd54, ftLastWriteTime.dwLowDateTime=0x3461be70, ftLastWriteTime.dwHighDateTime=0x1d5dd54, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.234] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed28 | out: lpFindFileData=0x5bbed28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5c45600, ftCreationTime.dwHighDateTime=0x1d5e2c2, ftLastAccessTime.dwLowDateTime=0x297c3500, ftLastAccessTime.dwHighDateTime=0x1d5e18a, ftLastWriteTime.dwLowDateTime=0x297c3500, ftLastWriteTime.dwHighDateTime=0x1d5e18a, nFileSizeHigh=0x0, nFileSizeLow=0x13a12, dwReserved0=0x0, dwReserved1=0x0, cFileName="e PdeInE20xW S.mkv", cAlternateFileName="EPDEIN~1.MKV")) returned 1 [0081.234] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed28 | out: lpFindFileData=0x5bbed28*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0081.234] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0081.234] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbefb0) returned 1 [0081.234] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbefbc) returned 1 [0081.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf034) returned 1 [0081.235] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1", nBufferLength=0x105, lpBuffer=0x5bbeb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1", lpFilePart=0x0) returned 0x3f [0081.235] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\", nBufferLength=0x105, lpBuffer=0x5bbeb10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\", lpFilePart=0x0) returned 0x40 [0081.235] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\*", lpFindFileData=0x5bbed5c | out: lpFindFileData=0x5bbed5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6adbab0, ftCreationTime.dwHighDateTime=0x1d5e21d, ftLastAccessTime.dwLowDateTime=0x6eceb9f0, ftLastAccessTime.dwHighDateTime=0x1d5e56f, ftLastWriteTime.dwLowDateTime=0x6eceb9f0, ftLastWriteTime.dwHighDateTime=0x1d5e56f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0081.235] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6adbab0, ftCreationTime.dwHighDateTime=0x1d5e21d, ftLastAccessTime.dwLowDateTime=0x6eceb9f0, ftLastAccessTime.dwHighDateTime=0x1d5e56f, ftLastWriteTime.dwLowDateTime=0x6eceb9f0, ftLastWriteTime.dwHighDateTime=0x1d5e56f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.235] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc724fd30, ftCreationTime.dwHighDateTime=0x1d5db7e, ftLastAccessTime.dwLowDateTime=0x3461be70, ftLastAccessTime.dwHighDateTime=0x1d5dd54, ftLastWriteTime.dwLowDateTime=0x3461be70, ftLastWriteTime.dwHighDateTime=0x1d5dd54, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1EBa", cAlternateFileName="")) returned 1 [0081.235] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62de3da0, ftCreationTime.dwHighDateTime=0x1d5d8e5, ftLastAccessTime.dwLowDateTime=0x51144910, ftLastAccessTime.dwHighDateTime=0x1d5e2f0, ftLastWriteTime.dwLowDateTime=0x51144910, ftLastWriteTime.dwHighDateTime=0x1d5e2f0, nFileSizeHigh=0x0, nFileSizeLow=0x8e9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="5qLoKDmvFfdmoFZ5v.avi", cAlternateFileName="5QLOKD~1.AVI")) returned 1 [0081.235] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6658fe0, ftCreationTime.dwHighDateTime=0x1d5ddc4, ftLastAccessTime.dwLowDateTime=0x24a09d40, ftLastAccessTime.dwHighDateTime=0x1d5d9ed, ftLastWriteTime.dwLowDateTime=0x24a09d40, ftLastWriteTime.dwHighDateTime=0x1d5d9ed, nFileSizeHigh=0x0, nFileSizeLow=0x18134, dwReserved0=0x0, dwReserved1=0x0, cFileName="6DZggA1Ty.flv", cAlternateFileName="6DZGGA~1.FLV")) returned 1 [0081.236] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0457700, ftCreationTime.dwHighDateTime=0x1d5dd3b, ftLastAccessTime.dwLowDateTime=0xede074b0, ftLastAccessTime.dwHighDateTime=0x1d5e149, ftLastWriteTime.dwLowDateTime=0xede074b0, ftLastWriteTime.dwHighDateTime=0x1d5e149, nFileSizeHigh=0x0, nFileSizeLow=0x2bde, dwReserved0=0x0, dwReserved1=0x0, cFileName="j5RouV1j7HnFN.mkv", cAlternateFileName="J5ROUV~1.MKV")) returned 1 [0081.236] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20799b00, ftCreationTime.dwHighDateTime=0x1d5e09f, ftLastAccessTime.dwLowDateTime=0xc78d7f60, ftLastAccessTime.dwHighDateTime=0x1d5e347, ftLastWriteTime.dwLowDateTime=0xc78d7f60, ftLastWriteTime.dwHighDateTime=0x1d5e347, nFileSizeHigh=0x0, nFileSizeLow=0x9f43, dwReserved0=0x0, dwReserved1=0x0, cFileName="NFagidh2b.avi", cAlternateFileName="NFAGID~1.AVI")) returned 1 [0081.236] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x291ccc50, ftCreationTime.dwHighDateTime=0x1d5dd6b, ftLastAccessTime.dwLowDateTime=0x11d73660, ftLastAccessTime.dwHighDateTime=0x1d5e2c1, ftLastWriteTime.dwLowDateTime=0x11d73660, ftLastWriteTime.dwHighDateTime=0x1d5e2c1, nFileSizeHigh=0x0, nFileSizeLow=0xd56c, dwReserved0=0x0, dwReserved1=0x0, cFileName="T9wsPG.mp4", cAlternateFileName="")) returned 1 [0081.236] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0081.236] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0081.236] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbeff4) returned 1 [0081.236] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf000) returned 1 [0081.236] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf078) returned 1 [0081.236] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN", nBufferLength=0x105, lpBuffer=0x5bbeb80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN", lpFilePart=0x0) returned 0x38 [0081.236] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\", nBufferLength=0x105, lpBuffer=0x5bbeb54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\", lpFilePart=0x0) returned 0x39 [0081.236] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\*", lpFindFileData=0x5bbeda0 | out: lpFindFileData=0x5bbeda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a3c9270, ftCreationTime.dwHighDateTime=0x1d5df2c, ftLastAccessTime.dwLowDateTime=0x5d8bbbc0, ftLastAccessTime.dwHighDateTime=0x1d5dc0a, ftLastWriteTime.dwLowDateTime=0x5d8bbbc0, ftLastWriteTime.dwHighDateTime=0x1d5dc0a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0081.237] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a3c9270, ftCreationTime.dwHighDateTime=0x1d5df2c, ftLastAccessTime.dwLowDateTime=0x5d8bbbc0, ftLastAccessTime.dwHighDateTime=0x1d5dc0a, ftLastWriteTime.dwLowDateTime=0x5d8bbbc0, ftLastWriteTime.dwHighDateTime=0x1d5dc0a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.237] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x470d0b90, ftCreationTime.dwHighDateTime=0x1d5da4a, ftLastAccessTime.dwLowDateTime=0x76263b20, ftLastAccessTime.dwHighDateTime=0x1d5e74e, ftLastWriteTime.dwLowDateTime=0x76263b20, ftLastWriteTime.dwHighDateTime=0x1d5e74e, nFileSizeHigh=0x0, nFileSizeLow=0x835b, dwReserved0=0x0, dwReserved1=0x0, cFileName="fu8Lf11wf4XDZYYv.mp4", cAlternateFileName="FU8LF1~1.MP4")) returned 1 [0081.237] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6adbab0, ftCreationTime.dwHighDateTime=0x1d5e21d, ftLastAccessTime.dwLowDateTime=0x6eceb9f0, ftLastAccessTime.dwHighDateTime=0x1d5e56f, ftLastWriteTime.dwLowDateTime=0x6eceb9f0, ftLastWriteTime.dwHighDateTime=0x1d5e56f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="R5LIt1", cAlternateFileName="")) returned 1 [0081.237] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6adbab0, ftCreationTime.dwHighDateTime=0x1d5e21d, ftLastAccessTime.dwLowDateTime=0x6eceb9f0, ftLastAccessTime.dwHighDateTime=0x1d5e56f, ftLastWriteTime.dwLowDateTime=0x6eceb9f0, ftLastWriteTime.dwHighDateTime=0x1d5e56f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="R5LIt1", cAlternateFileName="")) returned 0 [0081.237] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0081.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf038) returned 1 [0081.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf044) returned 1 [0081.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf0bc) returned 1 [0081.237] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7", nBufferLength=0x105, lpBuffer=0x5bbebc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7", lpFilePart=0x0) returned 0x31 [0081.238] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\", nBufferLength=0x105, lpBuffer=0x5bbeb98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\", lpFilePart=0x0) returned 0x32 [0081.238] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\*", lpFindFileData=0x5bbede4 | out: lpFindFileData=0x5bbede4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8bc769b0, ftCreationTime.dwHighDateTime=0x1d5e6f7, ftLastAccessTime.dwLowDateTime=0xdaac6e50, ftLastAccessTime.dwHighDateTime=0x1d5db39, ftLastWriteTime.dwLowDateTime=0xdaac6e50, ftLastWriteTime.dwHighDateTime=0x1d5db39, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0081.238] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8bc769b0, ftCreationTime.dwHighDateTime=0x1d5e6f7, ftLastAccessTime.dwLowDateTime=0xdaac6e50, ftLastAccessTime.dwHighDateTime=0x1d5db39, ftLastWriteTime.dwLowDateTime=0xdaac6e50, ftLastWriteTime.dwHighDateTime=0x1d5db39, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.238] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b0a9720, ftCreationTime.dwHighDateTime=0x1d5e290, ftLastAccessTime.dwLowDateTime=0x87d59150, ftLastAccessTime.dwHighDateTime=0x1d5d7e9, ftLastWriteTime.dwLowDateTime=0x87d59150, ftLastWriteTime.dwHighDateTime=0x1d5d7e9, nFileSizeHigh=0x0, nFileSizeLow=0x1268d, dwReserved0=0x0, dwReserved1=0x0, cFileName="bcQJ97S.flv", cAlternateFileName="")) returned 1 [0081.238] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a3c9270, ftCreationTime.dwHighDateTime=0x1d5df2c, ftLastAccessTime.dwLowDateTime=0x5d8bbbc0, ftLastAccessTime.dwHighDateTime=0x1d5dc0a, ftLastWriteTime.dwLowDateTime=0x5d8bbbc0, ftLastWriteTime.dwHighDateTime=0x1d5dc0a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jrlzcN", cAlternateFileName="")) returned 1 [0081.238] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb67e6b20, ftCreationTime.dwHighDateTime=0x1d5e4a6, ftLastAccessTime.dwLowDateTime=0x9f93d270, ftLastAccessTime.dwHighDateTime=0x1d5dad2, ftLastWriteTime.dwLowDateTime=0x9f93d270, ftLastWriteTime.dwHighDateTime=0x1d5dad2, nFileSizeHigh=0x0, nFileSizeLow=0x18ead, dwReserved0=0x0, dwReserved1=0x0, cFileName="VF-j.swf", cAlternateFileName="")) returned 1 [0081.238] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0081.239] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0081.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf07c) returned 1 [0081.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf088) returned 1 [0081.239] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\.", nBufferLength=0x105, lpBuffer=0x5bbebc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5", lpFilePart=0x0) returned 0x29 [0081.239] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5", nBufferLength=0x105, lpBuffer=0x5bbebf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5", lpFilePart=0x0) returned 0x29 [0081.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf050) returned 1 [0081.239] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sub5"), fInfoLevelId=0x0, lpFileInformation=0x5bbf0cc | out: lpFileInformation=0x5bbf0cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb66bf550, ftCreationTime.dwHighDateTime=0x1d5dde7, ftLastAccessTime.dwLowDateTime=0xb5e8c0d0, ftLastAccessTime.dwHighDateTime=0x1d5daa0, ftLastWriteTime.dwLowDateTime=0xb5e8c0d0, ftLastWriteTime.dwHighDateTime=0x1d5daa0, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0081.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf04c) returned 1 [0081.239] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5", nBufferLength=0x105, lpBuffer=0x5bbebf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5", lpFilePart=0x0) returned 0x29 [0081.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf0bc) returned 1 [0081.239] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5", nBufferLength=0x105, lpBuffer=0x5bbebc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5", lpFilePart=0x0) returned 0x29 [0081.239] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\", nBufferLength=0x105, lpBuffer=0x5bbeb98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\", lpFilePart=0x0) returned 0x2a [0081.239] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\*", lpFindFileData=0x5bbede4 | out: lpFindFileData=0x5bbede4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb66bf550, ftCreationTime.dwHighDateTime=0x1d5dde7, ftLastAccessTime.dwLowDateTime=0xb5e8c0d0, ftLastAccessTime.dwHighDateTime=0x1d5daa0, ftLastWriteTime.dwLowDateTime=0xb5e8c0d0, ftLastWriteTime.dwHighDateTime=0x1d5daa0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0081.240] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb66bf550, ftCreationTime.dwHighDateTime=0x1d5dde7, ftLastAccessTime.dwLowDateTime=0xb5e8c0d0, ftLastAccessTime.dwHighDateTime=0x1d5daa0, ftLastWriteTime.dwLowDateTime=0xb5e8c0d0, ftLastWriteTime.dwHighDateTime=0x1d5daa0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.240] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0b53df0, ftCreationTime.dwHighDateTime=0x1d5e41a, ftLastAccessTime.dwLowDateTime=0xb9a9ce20, ftLastAccessTime.dwHighDateTime=0x1d5e2bc, ftLastWriteTime.dwLowDateTime=0xb9a9ce20, ftLastWriteTime.dwHighDateTime=0x1d5e2bc, nFileSizeHigh=0x0, nFileSizeLow=0xaa4, dwReserved0=0x0, dwReserved1=0x0, cFileName="E4MXu.mkv", cAlternateFileName="")) returned 1 [0081.240] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f781250, ftCreationTime.dwHighDateTime=0x1d5dbf8, ftLastAccessTime.dwLowDateTime=0xdbf43e80, ftLastAccessTime.dwHighDateTime=0x1d5e2b6, ftLastWriteTime.dwLowDateTime=0xdbf43e80, ftLastWriteTime.dwHighDateTime=0x1d5e2b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jYyk68fsWCM3V_tNvj", cAlternateFileName="JYYK68~1")) returned 1 [0081.241] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x434b1b20, ftCreationTime.dwHighDateTime=0x1d5dfe8, ftLastAccessTime.dwLowDateTime=0x7e783d20, ftLastAccessTime.dwHighDateTime=0x1d5dda1, ftLastWriteTime.dwLowDateTime=0x7e783d20, ftLastWriteTime.dwHighDateTime=0x1d5dda1, nFileSizeHigh=0x0, nFileSizeLow=0x1271b, dwReserved0=0x0, dwReserved1=0x0, cFileName="kdGBxQsdPJhaK3.mkv", cAlternateFileName="KDGBXQ~1.MKV")) returned 1 [0081.241] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61f72140, ftCreationTime.dwHighDateTime=0x1d5de30, ftLastAccessTime.dwLowDateTime=0xd800b040, ftLastAccessTime.dwHighDateTime=0x1d5dd9f, ftLastWriteTime.dwLowDateTime=0xd800b040, ftLastWriteTime.dwHighDateTime=0x1d5dd9f, nFileSizeHigh=0x0, nFileSizeLow=0x7afc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SExsjX.mkv", cAlternateFileName="")) returned 1 [0081.241] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c04bec0, ftCreationTime.dwHighDateTime=0x1d5dd98, ftLastAccessTime.dwLowDateTime=0xcee97910, ftLastAccessTime.dwHighDateTime=0x1d5e605, ftLastWriteTime.dwLowDateTime=0xcee97910, ftLastWriteTime.dwHighDateTime=0x1d5e605, nFileSizeHigh=0x0, nFileSizeLow=0x154f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="sHZA.avi", cAlternateFileName="")) returned 1 [0081.241] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c04bec0, ftCreationTime.dwHighDateTime=0x1d5dd98, ftLastAccessTime.dwLowDateTime=0xcee97910, ftLastAccessTime.dwHighDateTime=0x1d5e605, ftLastWriteTime.dwLowDateTime=0xcee97910, ftLastWriteTime.dwHighDateTime=0x1d5e605, nFileSizeHigh=0x0, nFileSizeLow=0x154f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="sHZA.avi", cAlternateFileName="")) returned 0 [0081.241] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0081.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf07c) returned 1 [0081.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf088) returned 1 [0081.241] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\jYyk68fsWCM3V_tNvj\\.", nBufferLength=0x105, lpBuffer=0x5bbeb7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\jYyk68fsWCM3V_tNvj", lpFilePart=0x0) returned 0x3c [0081.241] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\jYyk68fsWCM3V_tNvj", nBufferLength=0x105, lpBuffer=0x5bbebb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\jYyk68fsWCM3V_tNvj", lpFilePart=0x0) returned 0x3c [0081.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf00c) returned 1 [0081.242] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\jYyk68fsWCM3V_tNvj" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sub5\\jyyk68fswcm3v_tnvj"), fInfoLevelId=0x0, lpFileInformation=0x5bbf088 | out: lpFileInformation=0x5bbf088*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f781250, ftCreationTime.dwHighDateTime=0x1d5dbf8, ftLastAccessTime.dwLowDateTime=0xdbf43e80, ftLastAccessTime.dwHighDateTime=0x1d5e2b6, ftLastWriteTime.dwLowDateTime=0xdbf43e80, ftLastWriteTime.dwHighDateTime=0x1d5e2b6, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0081.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf008) returned 1 [0081.242] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\jYyk68fsWCM3V_tNvj", nBufferLength=0x105, lpBuffer=0x5bbebb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\jYyk68fsWCM3V_tNvj", lpFilePart=0x0) returned 0x3c [0081.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf078) returned 1 [0081.242] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\jYyk68fsWCM3V_tNvj", nBufferLength=0x105, lpBuffer=0x5bbeb80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\jYyk68fsWCM3V_tNvj", lpFilePart=0x0) returned 0x3c [0081.242] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\jYyk68fsWCM3V_tNvj\\", nBufferLength=0x105, lpBuffer=0x5bbeb54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\jYyk68fsWCM3V_tNvj\\", lpFilePart=0x0) returned 0x3d [0081.242] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\jYyk68fsWCM3V_tNvj\\*", lpFindFileData=0x5bbeda0 | out: lpFindFileData=0x5bbeda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f781250, ftCreationTime.dwHighDateTime=0x1d5dbf8, ftLastAccessTime.dwLowDateTime=0xdbf43e80, ftLastAccessTime.dwHighDateTime=0x1d5e2b6, ftLastWriteTime.dwLowDateTime=0xdbf43e80, ftLastWriteTime.dwHighDateTime=0x1d5e2b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0081.242] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f781250, ftCreationTime.dwHighDateTime=0x1d5dbf8, ftLastAccessTime.dwLowDateTime=0xdbf43e80, ftLastAccessTime.dwHighDateTime=0x1d5e2b6, ftLastWriteTime.dwLowDateTime=0xdbf43e80, ftLastWriteTime.dwHighDateTime=0x1d5e2b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.242] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a68a020, ftCreationTime.dwHighDateTime=0x1d5e28f, ftLastAccessTime.dwLowDateTime=0xbd50c7f0, ftLastAccessTime.dwHighDateTime=0x1d5de9c, ftLastWriteTime.dwLowDateTime=0xbd50c7f0, ftLastWriteTime.dwHighDateTime=0x1d5de9c, nFileSizeHigh=0x0, nFileSizeLow=0x4e65, dwReserved0=0x0, dwReserved1=0x0, cFileName="SqxFtV7dupmJWSBtbws.flv", cAlternateFileName="SQXFTV~1.FLV")) returned 1 [0081.243] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde162270, ftCreationTime.dwHighDateTime=0x1d5dac6, ftLastAccessTime.dwLowDateTime=0x4937b0, ftLastAccessTime.dwHighDateTime=0x1d5e42c, ftLastWriteTime.dwLowDateTime=0x4937b0, ftLastWriteTime.dwHighDateTime=0x1d5e42c, nFileSizeHigh=0x0, nFileSizeLow=0xbd90, dwReserved0=0x0, dwReserved1=0x0, cFileName="XaYtXP MOExJDn1ZzXp.mp4", cAlternateFileName="XAYTXP~1.MP4")) returned 1 [0081.243] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde162270, ftCreationTime.dwHighDateTime=0x1d5dac6, ftLastAccessTime.dwLowDateTime=0x4937b0, ftLastAccessTime.dwHighDateTime=0x1d5e42c, ftLastWriteTime.dwLowDateTime=0x4937b0, ftLastWriteTime.dwHighDateTime=0x1d5e42c, nFileSizeHigh=0x0, nFileSizeLow=0xbd90, dwReserved0=0x0, dwReserved1=0x0, cFileName="XaYtXP MOExJDn1ZzXp.mp4", cAlternateFileName="XAYTXP~1.MP4")) returned 0 [0081.243] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0081.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf038) returned 1 [0081.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf044) returned 1 [0081.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf078) returned 1 [0081.243] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\jYyk68fsWCM3V_tNvj", nBufferLength=0x105, lpBuffer=0x5bbeb80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\jYyk68fsWCM3V_tNvj", lpFilePart=0x0) returned 0x3c [0081.243] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\jYyk68fsWCM3V_tNvj\\", nBufferLength=0x105, lpBuffer=0x5bbeb54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\jYyk68fsWCM3V_tNvj\\", lpFilePart=0x0) returned 0x3d [0081.243] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\jYyk68fsWCM3V_tNvj\\*", lpFindFileData=0x5bbeda0 | out: lpFindFileData=0x5bbeda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f781250, ftCreationTime.dwHighDateTime=0x1d5dbf8, ftLastAccessTime.dwLowDateTime=0xdbf43e80, ftLastAccessTime.dwHighDateTime=0x1d5e2b6, ftLastWriteTime.dwLowDateTime=0xdbf43e80, ftLastWriteTime.dwHighDateTime=0x1d5e2b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0081.244] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f781250, ftCreationTime.dwHighDateTime=0x1d5dbf8, ftLastAccessTime.dwLowDateTime=0xdbf43e80, ftLastAccessTime.dwHighDateTime=0x1d5e2b6, ftLastWriteTime.dwLowDateTime=0xdbf43e80, ftLastWriteTime.dwHighDateTime=0x1d5e2b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.244] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a68a020, ftCreationTime.dwHighDateTime=0x1d5e28f, ftLastAccessTime.dwLowDateTime=0xbd50c7f0, ftLastAccessTime.dwHighDateTime=0x1d5de9c, ftLastWriteTime.dwLowDateTime=0xbd50c7f0, ftLastWriteTime.dwHighDateTime=0x1d5de9c, nFileSizeHigh=0x0, nFileSizeLow=0x4e65, dwReserved0=0x0, dwReserved1=0x0, cFileName="SqxFtV7dupmJWSBtbws.flv", cAlternateFileName="SQXFTV~1.FLV")) returned 1 [0081.244] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde162270, ftCreationTime.dwHighDateTime=0x1d5dac6, ftLastAccessTime.dwLowDateTime=0x4937b0, ftLastAccessTime.dwHighDateTime=0x1d5e42c, ftLastWriteTime.dwLowDateTime=0x4937b0, ftLastWriteTime.dwHighDateTime=0x1d5e42c, nFileSizeHigh=0x0, nFileSizeLow=0xbd90, dwReserved0=0x0, dwReserved1=0x0, cFileName="XaYtXP MOExJDn1ZzXp.mp4", cAlternateFileName="XAYTXP~1.MP4")) returned 1 [0081.244] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0081.244] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0081.244] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf038) returned 1 [0081.244] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf044) returned 1 [0081.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf0bc) returned 1 [0081.245] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5", nBufferLength=0x105, lpBuffer=0x5bbebc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5", lpFilePart=0x0) returned 0x29 [0081.245] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\", nBufferLength=0x105, lpBuffer=0x5bbeb98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\", lpFilePart=0x0) returned 0x2a [0081.245] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\*", lpFindFileData=0x5bbede4 | out: lpFindFileData=0x5bbede4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb66bf550, ftCreationTime.dwHighDateTime=0x1d5dde7, ftLastAccessTime.dwLowDateTime=0xb5e8c0d0, ftLastAccessTime.dwHighDateTime=0x1d5daa0, ftLastWriteTime.dwLowDateTime=0xb5e8c0d0, ftLastWriteTime.dwHighDateTime=0x1d5daa0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0081.245] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb66bf550, ftCreationTime.dwHighDateTime=0x1d5dde7, ftLastAccessTime.dwLowDateTime=0xb5e8c0d0, ftLastAccessTime.dwHighDateTime=0x1d5daa0, ftLastWriteTime.dwLowDateTime=0xb5e8c0d0, ftLastWriteTime.dwHighDateTime=0x1d5daa0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.245] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0b53df0, ftCreationTime.dwHighDateTime=0x1d5e41a, ftLastAccessTime.dwLowDateTime=0xb9a9ce20, ftLastAccessTime.dwHighDateTime=0x1d5e2bc, ftLastWriteTime.dwLowDateTime=0xb9a9ce20, ftLastWriteTime.dwHighDateTime=0x1d5e2bc, nFileSizeHigh=0x0, nFileSizeLow=0xaa4, dwReserved0=0x0, dwReserved1=0x0, cFileName="E4MXu.mkv", cAlternateFileName="")) returned 1 [0081.246] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f781250, ftCreationTime.dwHighDateTime=0x1d5dbf8, ftLastAccessTime.dwLowDateTime=0xdbf43e80, ftLastAccessTime.dwHighDateTime=0x1d5e2b6, ftLastWriteTime.dwLowDateTime=0xdbf43e80, ftLastWriteTime.dwHighDateTime=0x1d5e2b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jYyk68fsWCM3V_tNvj", cAlternateFileName="JYYK68~1")) returned 1 [0081.246] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x434b1b20, ftCreationTime.dwHighDateTime=0x1d5dfe8, ftLastAccessTime.dwLowDateTime=0x7e783d20, ftLastAccessTime.dwHighDateTime=0x1d5dda1, ftLastWriteTime.dwLowDateTime=0x7e783d20, ftLastWriteTime.dwHighDateTime=0x1d5dda1, nFileSizeHigh=0x0, nFileSizeLow=0x1271b, dwReserved0=0x0, dwReserved1=0x0, cFileName="kdGBxQsdPJhaK3.mkv", cAlternateFileName="KDGBXQ~1.MKV")) returned 1 [0081.246] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61f72140, ftCreationTime.dwHighDateTime=0x1d5de30, ftLastAccessTime.dwLowDateTime=0xd800b040, ftLastAccessTime.dwHighDateTime=0x1d5dd9f, ftLastWriteTime.dwLowDateTime=0xd800b040, ftLastWriteTime.dwHighDateTime=0x1d5dd9f, nFileSizeHigh=0x0, nFileSizeLow=0x7afc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SExsjX.mkv", cAlternateFileName="")) returned 1 [0081.246] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c04bec0, ftCreationTime.dwHighDateTime=0x1d5dd98, ftLastAccessTime.dwLowDateTime=0xcee97910, ftLastAccessTime.dwHighDateTime=0x1d5e605, ftLastWriteTime.dwLowDateTime=0xcee97910, ftLastWriteTime.dwHighDateTime=0x1d5e605, nFileSizeHigh=0x0, nFileSizeLow=0x154f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="sHZA.avi", cAlternateFileName="")) returned 1 [0081.246] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0081.246] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0081.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf07c) returned 1 [0081.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf088) returned 1 [0081.246] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\.", nBufferLength=0x105, lpBuffer=0x5bbebc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana", lpFilePart=0x0) returned 0x2d [0081.247] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana", nBufferLength=0x105, lpBuffer=0x5bbebf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana", lpFilePart=0x0) returned 0x2d [0081.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf050) returned 1 [0081.247] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\yndaxana"), fInfoLevelId=0x0, lpFileInformation=0x5bbf0cc | out: lpFileInformation=0x5bbf0cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67c14b80, ftCreationTime.dwHighDateTime=0x1d5dd79, ftLastAccessTime.dwLowDateTime=0x4065cb70, ftLastAccessTime.dwHighDateTime=0x1d5e38b, ftLastWriteTime.dwLowDateTime=0x4065cb70, ftLastWriteTime.dwHighDateTime=0x1d5e38b, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0081.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf04c) returned 1 [0081.247] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana", nBufferLength=0x105, lpBuffer=0x5bbebf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana", lpFilePart=0x0) returned 0x2d [0081.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf0bc) returned 1 [0081.247] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana", nBufferLength=0x105, lpBuffer=0x5bbebc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana", lpFilePart=0x0) returned 0x2d [0081.247] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\", nBufferLength=0x105, lpBuffer=0x5bbeb98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\", lpFilePart=0x0) returned 0x2e [0081.247] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\*", lpFindFileData=0x5bbede4 | out: lpFindFileData=0x5bbede4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67c14b80, ftCreationTime.dwHighDateTime=0x1d5dd79, ftLastAccessTime.dwLowDateTime=0x4065cb70, ftLastAccessTime.dwHighDateTime=0x1d5e38b, ftLastWriteTime.dwLowDateTime=0x4065cb70, ftLastWriteTime.dwHighDateTime=0x1d5e38b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0081.247] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67c14b80, ftCreationTime.dwHighDateTime=0x1d5dd79, ftLastAccessTime.dwLowDateTime=0x4065cb70, ftLastAccessTime.dwHighDateTime=0x1d5e38b, ftLastWriteTime.dwLowDateTime=0x4065cb70, ftLastWriteTime.dwHighDateTime=0x1d5e38b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.247] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c791a90, ftCreationTime.dwHighDateTime=0x1d5da81, ftLastAccessTime.dwLowDateTime=0x11a7be50, ftLastAccessTime.dwHighDateTime=0x1d5de55, ftLastWriteTime.dwLowDateTime=0x11a7be50, ftLastWriteTime.dwHighDateTime=0x1d5de55, nFileSizeHigh=0x0, nFileSizeLow=0xd928, dwReserved0=0x0, dwReserved1=0x0, cFileName="4jHEZJBZezOPue0 sTIX.flv", cAlternateFileName="4JHEZJ~1.FLV")) returned 1 [0081.248] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x632ac780, ftCreationTime.dwHighDateTime=0x1d5e48c, ftLastAccessTime.dwLowDateTime=0x13b233f0, ftLastAccessTime.dwHighDateTime=0x1d5de0b, ftLastWriteTime.dwLowDateTime=0x13b233f0, ftLastWriteTime.dwHighDateTime=0x1d5de0b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="64N32d", cAlternateFileName="")) returned 1 [0081.248] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xceaf3120, ftCreationTime.dwHighDateTime=0x1d5e1d1, ftLastAccessTime.dwLowDateTime=0xb1d4bcc0, ftLastAccessTime.dwHighDateTime=0x1d5db30, ftLastWriteTime.dwLowDateTime=0xb1d4bcc0, ftLastWriteTime.dwHighDateTime=0x1d5db30, nFileSizeHigh=0x0, nFileSizeLow=0x458d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Egf5GFS8CpmXGKA6.swf", cAlternateFileName="EGF5GF~1.SWF")) returned 1 [0081.248] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x272d5cd0, ftCreationTime.dwHighDateTime=0x1d5e418, ftLastAccessTime.dwLowDateTime=0x776fe660, ftLastAccessTime.dwHighDateTime=0x1d5e0f1, ftLastWriteTime.dwLowDateTime=0x776fe660, ftLastWriteTime.dwHighDateTime=0x1d5e0f1, nFileSizeHigh=0x0, nFileSizeLow=0x8a7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MFQpy_VaHtxqEb10.swf", cAlternateFileName="MFQPY_~1.SWF")) returned 1 [0081.248] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3106fb0, ftCreationTime.dwHighDateTime=0x1d5e7c2, ftLastAccessTime.dwLowDateTime=0x3ba9cd50, ftLastAccessTime.dwHighDateTime=0x1d5e207, ftLastWriteTime.dwLowDateTime=0x3ba9cd50, ftLastWriteTime.dwHighDateTime=0x1d5e207, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NEJg", cAlternateFileName="")) returned 1 [0081.248] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0081.248] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0081.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf07c) returned 1 [0081.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf088) returned 1 [0081.249] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\64N32d\\.", nBufferLength=0x105, lpBuffer=0x5bbeb7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\64N32d", lpFilePart=0x0) returned 0x34 [0081.249] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\64N32d", nBufferLength=0x105, lpBuffer=0x5bbebb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\64N32d", lpFilePart=0x0) returned 0x34 [0081.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf00c) returned 1 [0081.249] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\64N32d" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\yndaxana\\64n32d"), fInfoLevelId=0x0, lpFileInformation=0x5bbf088 | out: lpFileInformation=0x5bbf088*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x632ac780, ftCreationTime.dwHighDateTime=0x1d5e48c, ftLastAccessTime.dwLowDateTime=0x13b233f0, ftLastAccessTime.dwHighDateTime=0x1d5de0b, ftLastWriteTime.dwLowDateTime=0x13b233f0, ftLastWriteTime.dwHighDateTime=0x1d5de0b, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0081.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf008) returned 1 [0081.249] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\64N32d", nBufferLength=0x105, lpBuffer=0x5bbebb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\64N32d", lpFilePart=0x0) returned 0x34 [0081.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf078) returned 1 [0081.249] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\64N32d", nBufferLength=0x105, lpBuffer=0x5bbeb80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\64N32d", lpFilePart=0x0) returned 0x34 [0081.249] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\64N32d\\", nBufferLength=0x105, lpBuffer=0x5bbeb54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\64N32d\\", lpFilePart=0x0) returned 0x35 [0081.249] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\64N32d\\*", lpFindFileData=0x5bbeda0 | out: lpFindFileData=0x5bbeda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x632ac780, ftCreationTime.dwHighDateTime=0x1d5e48c, ftLastAccessTime.dwLowDateTime=0x13b233f0, ftLastAccessTime.dwHighDateTime=0x1d5de0b, ftLastWriteTime.dwLowDateTime=0x13b233f0, ftLastWriteTime.dwHighDateTime=0x1d5de0b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0081.250] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x632ac780, ftCreationTime.dwHighDateTime=0x1d5e48c, ftLastAccessTime.dwLowDateTime=0x13b233f0, ftLastAccessTime.dwHighDateTime=0x1d5de0b, ftLastWriteTime.dwLowDateTime=0x13b233f0, ftLastWriteTime.dwHighDateTime=0x1d5de0b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.250] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff2618a0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x8a5e5bf0, ftLastAccessTime.dwHighDateTime=0x1d5d992, ftLastWriteTime.dwLowDateTime=0x8a5e5bf0, ftLastWriteTime.dwHighDateTime=0x1d5d992, nFileSizeHigh=0x0, nFileSizeLow=0x15ebe, dwReserved0=0x0, dwReserved1=0x0, cFileName="aijo4jBqwJrSLrg.flv", cAlternateFileName="AIJO4J~1.FLV")) returned 1 [0081.250] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d7d09b0, ftCreationTime.dwHighDateTime=0x1d5ddee, ftLastAccessTime.dwLowDateTime=0xf44bd300, ftLastAccessTime.dwHighDateTime=0x1d5e3ea, ftLastWriteTime.dwLowDateTime=0xf44bd300, ftLastWriteTime.dwHighDateTime=0x1d5e3ea, nFileSizeHigh=0x0, nFileSizeLow=0x4243, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hb30BdSPFe8NaExh.mkv", cAlternateFileName="HB30BD~1.MKV")) returned 1 [0081.250] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88b8d860, ftCreationTime.dwHighDateTime=0x1d5e5be, ftLastAccessTime.dwLowDateTime=0xbcf96cc0, ftLastAccessTime.dwHighDateTime=0x1d5e4c9, ftLastWriteTime.dwLowDateTime=0xbcf96cc0, ftLastWriteTime.dwHighDateTime=0x1d5e4c9, nFileSizeHigh=0x0, nFileSizeLow=0x1bcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="iwRGDoe8gG2XUv_Yl.swf", cAlternateFileName="IWRGDO~1.SWF")) returned 1 [0081.250] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5928fd10, ftCreationTime.dwHighDateTime=0x1d5e38d, ftLastAccessTime.dwLowDateTime=0xed43c940, ftLastAccessTime.dwHighDateTime=0x1d5df09, ftLastWriteTime.dwLowDateTime=0xed43c940, ftLastWriteTime.dwHighDateTime=0x1d5df09, nFileSizeHigh=0x0, nFileSizeLow=0x7060, dwReserved0=0x0, dwReserved1=0x0, cFileName="QbvMtNh4lRDdZhND797.avi", cAlternateFileName="QBVMTN~1.AVI")) returned 1 [0081.251] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5928fd10, ftCreationTime.dwHighDateTime=0x1d5e38d, ftLastAccessTime.dwLowDateTime=0xed43c940, ftLastAccessTime.dwHighDateTime=0x1d5df09, ftLastWriteTime.dwLowDateTime=0xed43c940, ftLastWriteTime.dwHighDateTime=0x1d5df09, nFileSizeHigh=0x0, nFileSizeLow=0x7060, dwReserved0=0x0, dwReserved1=0x0, cFileName="QbvMtNh4lRDdZhND797.avi", cAlternateFileName="QBVMTN~1.AVI")) returned 0 [0081.251] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0081.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf038) returned 1 [0081.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf044) returned 1 [0081.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf078) returned 1 [0081.251] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\64N32d", nBufferLength=0x105, lpBuffer=0x5bbeb80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\64N32d", lpFilePart=0x0) returned 0x34 [0081.251] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\64N32d\\", nBufferLength=0x105, lpBuffer=0x5bbeb54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\64N32d\\", lpFilePart=0x0) returned 0x35 [0081.251] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\64N32d\\*", lpFindFileData=0x5bbeda0 | out: lpFindFileData=0x5bbeda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x632ac780, ftCreationTime.dwHighDateTime=0x1d5e48c, ftLastAccessTime.dwLowDateTime=0x13b233f0, ftLastAccessTime.dwHighDateTime=0x1d5de0b, ftLastWriteTime.dwLowDateTime=0x13b233f0, ftLastWriteTime.dwHighDateTime=0x1d5de0b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0081.251] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x632ac780, ftCreationTime.dwHighDateTime=0x1d5e48c, ftLastAccessTime.dwLowDateTime=0x13b233f0, ftLastAccessTime.dwHighDateTime=0x1d5de0b, ftLastWriteTime.dwLowDateTime=0x13b233f0, ftLastWriteTime.dwHighDateTime=0x1d5de0b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.252] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff2618a0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x8a5e5bf0, ftLastAccessTime.dwHighDateTime=0x1d5d992, ftLastWriteTime.dwLowDateTime=0x8a5e5bf0, ftLastWriteTime.dwHighDateTime=0x1d5d992, nFileSizeHigh=0x0, nFileSizeLow=0x15ebe, dwReserved0=0x0, dwReserved1=0x0, cFileName="aijo4jBqwJrSLrg.flv", cAlternateFileName="AIJO4J~1.FLV")) returned 1 [0081.252] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d7d09b0, ftCreationTime.dwHighDateTime=0x1d5ddee, ftLastAccessTime.dwLowDateTime=0xf44bd300, ftLastAccessTime.dwHighDateTime=0x1d5e3ea, ftLastWriteTime.dwLowDateTime=0xf44bd300, ftLastWriteTime.dwHighDateTime=0x1d5e3ea, nFileSizeHigh=0x0, nFileSizeLow=0x4243, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hb30BdSPFe8NaExh.mkv", cAlternateFileName="HB30BD~1.MKV")) returned 1 [0081.252] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88b8d860, ftCreationTime.dwHighDateTime=0x1d5e5be, ftLastAccessTime.dwLowDateTime=0xbcf96cc0, ftLastAccessTime.dwHighDateTime=0x1d5e4c9, ftLastWriteTime.dwLowDateTime=0xbcf96cc0, ftLastWriteTime.dwHighDateTime=0x1d5e4c9, nFileSizeHigh=0x0, nFileSizeLow=0x1bcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="iwRGDoe8gG2XUv_Yl.swf", cAlternateFileName="IWRGDO~1.SWF")) returned 1 [0081.252] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5928fd10, ftCreationTime.dwHighDateTime=0x1d5e38d, ftLastAccessTime.dwLowDateTime=0xed43c940, ftLastAccessTime.dwHighDateTime=0x1d5df09, ftLastWriteTime.dwLowDateTime=0xed43c940, ftLastWriteTime.dwHighDateTime=0x1d5df09, nFileSizeHigh=0x0, nFileSizeLow=0x7060, dwReserved0=0x0, dwReserved1=0x0, cFileName="QbvMtNh4lRDdZhND797.avi", cAlternateFileName="QBVMTN~1.AVI")) returned 1 [0081.253] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0081.253] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0081.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf038) returned 1 [0081.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf044) returned 1 [0081.253] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\NEJg\\.", nBufferLength=0x105, lpBuffer=0x5bbeb7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\NEJg", lpFilePart=0x0) returned 0x32 [0081.253] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\NEJg", nBufferLength=0x105, lpBuffer=0x5bbebb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\NEJg", lpFilePart=0x0) returned 0x32 [0081.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf00c) returned 1 [0081.253] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\NEJg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\yndaxana\\nejg"), fInfoLevelId=0x0, lpFileInformation=0x5bbf088 | out: lpFileInformation=0x5bbf088*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3106fb0, ftCreationTime.dwHighDateTime=0x1d5e7c2, ftLastAccessTime.dwLowDateTime=0x3ba9cd50, ftLastAccessTime.dwHighDateTime=0x1d5e207, ftLastWriteTime.dwLowDateTime=0x3ba9cd50, ftLastWriteTime.dwHighDateTime=0x1d5e207, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0081.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf008) returned 1 [0081.254] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\NEJg", nBufferLength=0x105, lpBuffer=0x5bbebb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\NEJg", lpFilePart=0x0) returned 0x32 [0081.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf078) returned 1 [0081.254] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\NEJg", nBufferLength=0x105, lpBuffer=0x5bbeb80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\NEJg", lpFilePart=0x0) returned 0x32 [0081.254] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\NEJg\\", nBufferLength=0x105, lpBuffer=0x5bbeb54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\NEJg\\", lpFilePart=0x0) returned 0x33 [0081.254] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\NEJg\\*", lpFindFileData=0x5bbeda0 | out: lpFindFileData=0x5bbeda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3106fb0, ftCreationTime.dwHighDateTime=0x1d5e7c2, ftLastAccessTime.dwLowDateTime=0x3ba9cd50, ftLastAccessTime.dwHighDateTime=0x1d5e207, ftLastWriteTime.dwLowDateTime=0x3ba9cd50, ftLastWriteTime.dwHighDateTime=0x1d5e207, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0081.254] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3106fb0, ftCreationTime.dwHighDateTime=0x1d5e7c2, ftLastAccessTime.dwLowDateTime=0x3ba9cd50, ftLastAccessTime.dwHighDateTime=0x1d5e207, ftLastWriteTime.dwLowDateTime=0x3ba9cd50, ftLastWriteTime.dwHighDateTime=0x1d5e207, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.255] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7910a2b0, ftCreationTime.dwHighDateTime=0x1d5ddff, ftLastAccessTime.dwLowDateTime=0x7e8b30d0, ftLastAccessTime.dwHighDateTime=0x1d5d92b, ftLastWriteTime.dwLowDateTime=0x7e8b30d0, ftLastWriteTime.dwHighDateTime=0x1d5d92b, nFileSizeHigh=0x0, nFileSizeLow=0xf349, dwReserved0=0x0, dwReserved1=0x0, cFileName="7F6Iph4PnCV9Qug.swf", cAlternateFileName="7F6IPH~1.SWF")) returned 1 [0081.255] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25e0a5f0, ftCreationTime.dwHighDateTime=0x1d5d8fe, ftLastAccessTime.dwLowDateTime=0x89371c60, ftLastAccessTime.dwHighDateTime=0x1d5dc37, ftLastWriteTime.dwLowDateTime=0x89371c60, ftLastWriteTime.dwHighDateTime=0x1d5dc37, nFileSizeHigh=0x0, nFileSizeLow=0xcdc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="m1xg5305C6mxNxFxTi.mp4", cAlternateFileName="M1XG53~1.MP4")) returned 1 [0081.255] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25e0a5f0, ftCreationTime.dwHighDateTime=0x1d5d8fe, ftLastAccessTime.dwLowDateTime=0x89371c60, ftLastAccessTime.dwHighDateTime=0x1d5dc37, ftLastWriteTime.dwLowDateTime=0x89371c60, ftLastWriteTime.dwHighDateTime=0x1d5dc37, nFileSizeHigh=0x0, nFileSizeLow=0xcdc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="m1xg5305C6mxNxFxTi.mp4", cAlternateFileName="M1XG53~1.MP4")) returned 0 [0081.255] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0081.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf038) returned 1 [0081.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf044) returned 1 [0081.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf078) returned 1 [0081.255] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\NEJg", nBufferLength=0x105, lpBuffer=0x5bbeb80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\NEJg", lpFilePart=0x0) returned 0x32 [0081.256] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\NEJg\\", nBufferLength=0x105, lpBuffer=0x5bbeb54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\NEJg\\", lpFilePart=0x0) returned 0x33 [0081.256] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\NEJg\\*", lpFindFileData=0x5bbeda0 | out: lpFindFileData=0x5bbeda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3106fb0, ftCreationTime.dwHighDateTime=0x1d5e7c2, ftLastAccessTime.dwLowDateTime=0x3ba9cd50, ftLastAccessTime.dwHighDateTime=0x1d5e207, ftLastWriteTime.dwLowDateTime=0x3ba9cd50, ftLastWriteTime.dwHighDateTime=0x1d5e207, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0081.256] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3106fb0, ftCreationTime.dwHighDateTime=0x1d5e7c2, ftLastAccessTime.dwLowDateTime=0x3ba9cd50, ftLastAccessTime.dwHighDateTime=0x1d5e207, ftLastWriteTime.dwLowDateTime=0x3ba9cd50, ftLastWriteTime.dwHighDateTime=0x1d5e207, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.256] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7910a2b0, ftCreationTime.dwHighDateTime=0x1d5ddff, ftLastAccessTime.dwLowDateTime=0x7e8b30d0, ftLastAccessTime.dwHighDateTime=0x1d5d92b, ftLastWriteTime.dwLowDateTime=0x7e8b30d0, ftLastWriteTime.dwHighDateTime=0x1d5d92b, nFileSizeHigh=0x0, nFileSizeLow=0xf349, dwReserved0=0x0, dwReserved1=0x0, cFileName="7F6Iph4PnCV9Qug.swf", cAlternateFileName="7F6IPH~1.SWF")) returned 1 [0081.256] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25e0a5f0, ftCreationTime.dwHighDateTime=0x1d5d8fe, ftLastAccessTime.dwLowDateTime=0x89371c60, ftLastAccessTime.dwHighDateTime=0x1d5dc37, ftLastWriteTime.dwLowDateTime=0x89371c60, ftLastWriteTime.dwHighDateTime=0x1d5dc37, nFileSizeHigh=0x0, nFileSizeLow=0xcdc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="m1xg5305C6mxNxFxTi.mp4", cAlternateFileName="M1XG53~1.MP4")) returned 1 [0081.256] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0081.257] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0081.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf038) returned 1 [0081.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf044) returned 1 [0081.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf0bc) returned 1 [0081.257] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana", nBufferLength=0x105, lpBuffer=0x5bbebc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana", lpFilePart=0x0) returned 0x2d [0081.257] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\", nBufferLength=0x105, lpBuffer=0x5bbeb98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\", lpFilePart=0x0) returned 0x2e [0081.257] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\*", lpFindFileData=0x5bbede4 | out: lpFindFileData=0x5bbede4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67c14b80, ftCreationTime.dwHighDateTime=0x1d5dd79, ftLastAccessTime.dwLowDateTime=0x4065cb70, ftLastAccessTime.dwHighDateTime=0x1d5e38b, ftLastWriteTime.dwLowDateTime=0x4065cb70, ftLastWriteTime.dwHighDateTime=0x1d5e38b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0081.257] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67c14b80, ftCreationTime.dwHighDateTime=0x1d5dd79, ftLastAccessTime.dwLowDateTime=0x4065cb70, ftLastAccessTime.dwHighDateTime=0x1d5e38b, ftLastWriteTime.dwLowDateTime=0x4065cb70, ftLastWriteTime.dwHighDateTime=0x1d5e38b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.258] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c791a90, ftCreationTime.dwHighDateTime=0x1d5da81, ftLastAccessTime.dwLowDateTime=0x11a7be50, ftLastAccessTime.dwHighDateTime=0x1d5de55, ftLastWriteTime.dwLowDateTime=0x11a7be50, ftLastWriteTime.dwHighDateTime=0x1d5de55, nFileSizeHigh=0x0, nFileSizeLow=0xd928, dwReserved0=0x0, dwReserved1=0x0, cFileName="4jHEZJBZezOPue0 sTIX.flv", cAlternateFileName="4JHEZJ~1.FLV")) returned 1 [0081.258] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x632ac780, ftCreationTime.dwHighDateTime=0x1d5e48c, ftLastAccessTime.dwLowDateTime=0x13b233f0, ftLastAccessTime.dwHighDateTime=0x1d5de0b, ftLastWriteTime.dwLowDateTime=0x13b233f0, ftLastWriteTime.dwHighDateTime=0x1d5de0b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="64N32d", cAlternateFileName="")) returned 1 [0081.258] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xceaf3120, ftCreationTime.dwHighDateTime=0x1d5e1d1, ftLastAccessTime.dwLowDateTime=0xb1d4bcc0, ftLastAccessTime.dwHighDateTime=0x1d5db30, ftLastWriteTime.dwLowDateTime=0xb1d4bcc0, ftLastWriteTime.dwHighDateTime=0x1d5db30, nFileSizeHigh=0x0, nFileSizeLow=0x458d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Egf5GFS8CpmXGKA6.swf", cAlternateFileName="EGF5GF~1.SWF")) returned 1 [0081.258] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x272d5cd0, ftCreationTime.dwHighDateTime=0x1d5e418, ftLastAccessTime.dwLowDateTime=0x776fe660, ftLastAccessTime.dwHighDateTime=0x1d5e0f1, ftLastWriteTime.dwLowDateTime=0x776fe660, ftLastWriteTime.dwHighDateTime=0x1d5e0f1, nFileSizeHigh=0x0, nFileSizeLow=0x8a7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MFQpy_VaHtxqEb10.swf", cAlternateFileName="MFQPY_~1.SWF")) returned 1 [0081.258] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3106fb0, ftCreationTime.dwHighDateTime=0x1d5e7c2, ftLastAccessTime.dwLowDateTime=0x3ba9cd50, ftLastAccessTime.dwHighDateTime=0x1d5e207, ftLastWriteTime.dwLowDateTime=0x3ba9cd50, ftLastWriteTime.dwHighDateTime=0x1d5e207, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NEJg", cAlternateFileName="")) returned 1 [0081.259] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3106fb0, ftCreationTime.dwHighDateTime=0x1d5e7c2, ftLastAccessTime.dwLowDateTime=0x3ba9cd50, ftLastAccessTime.dwHighDateTime=0x1d5e207, ftLastWriteTime.dwLowDateTime=0x3ba9cd50, ftLastWriteTime.dwHighDateTime=0x1d5e207, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NEJg", cAlternateFileName="")) returned 0 [0081.259] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0081.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf07c) returned 1 [0081.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf088) returned 1 [0081.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf100) returned 1 [0081.259] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos", nBufferLength=0x105, lpBuffer=0x5bbec08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos", lpFilePart=0x0) returned 0x24 [0081.259] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\", nBufferLength=0x105, lpBuffer=0x5bbebdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\", lpFilePart=0x0) returned 0x25 [0081.259] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\*", lpFindFileData=0x5bbee28 | out: lpFindFileData=0x5bbee28*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdbf11ce0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf11ce0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0081.259] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdbf11ce0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf11ce0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.260] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8bc769b0, ftCreationTime.dwHighDateTime=0x1d5e6f7, ftLastAccessTime.dwLowDateTime=0xdaac6e50, ftLastAccessTime.dwHighDateTime=0x1d5db39, ftLastWriteTime.dwLowDateTime=0xdaac6e50, ftLastWriteTime.dwHighDateTime=0x1d5db39, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1Xq74mC5Z6A7", cAlternateFileName="1XQ74M~1")) returned 1 [0081.260] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f0f6890, ftCreationTime.dwHighDateTime=0x1d5de6e, ftLastAccessTime.dwLowDateTime=0xc0915950, ftLastAccessTime.dwHighDateTime=0x1d5e0d3, ftLastWriteTime.dwLowDateTime=0xc0915950, ftLastWriteTime.dwHighDateTime=0x1d5e0d3, nFileSizeHigh=0x0, nFileSizeLow=0xa1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="AKpjDRBtV4E.flv", cAlternateFileName="AKPJDR~1.FLV")) returned 1 [0081.260] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0081.260] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x370dc2f0, ftCreationTime.dwHighDateTime=0x1d5e136, ftLastAccessTime.dwLowDateTime=0x6c325100, ftLastAccessTime.dwHighDateTime=0x1d5d9e6, ftLastWriteTime.dwLowDateTime=0x6c325100, ftLastWriteTime.dwHighDateTime=0x1d5d9e6, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="iz6YTcyqH6vys1VH.mp4", cAlternateFileName="IZ6YTC~1.MP4")) returned 1 [0081.586] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb66bf550, ftCreationTime.dwHighDateTime=0x1d5dde7, ftLastAccessTime.dwLowDateTime=0xb5e8c0d0, ftLastAccessTime.dwHighDateTime=0x1d5daa0, ftLastWriteTime.dwLowDateTime=0xb5e8c0d0, ftLastWriteTime.dwHighDateTime=0x1d5daa0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sUB5", cAlternateFileName="")) returned 1 [0081.586] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5e489d0, ftCreationTime.dwHighDateTime=0x1d5e6a8, ftLastAccessTime.dwLowDateTime=0x5db58210, ftLastAccessTime.dwHighDateTime=0x1d5e3e5, ftLastWriteTime.dwLowDateTime=0x5db58210, ftLastWriteTime.dwHighDateTime=0x1d5e3e5, nFileSizeHigh=0x0, nFileSizeLow=0x4735, dwReserved0=0x0, dwReserved1=0x0, cFileName="t1Wr.flv", cAlternateFileName="")) returned 1 [0081.586] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67c14b80, ftCreationTime.dwHighDateTime=0x1d5dd79, ftLastAccessTime.dwLowDateTime=0x4065cb70, ftLastAccessTime.dwHighDateTime=0x1d5e38b, ftLastWriteTime.dwLowDateTime=0x4065cb70, ftLastWriteTime.dwHighDateTime=0x1d5e38b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="yndAXana", cAlternateFileName="")) returned 1 [0081.587] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67c14b80, ftCreationTime.dwHighDateTime=0x1d5dd79, ftLastAccessTime.dwLowDateTime=0x4065cb70, ftLastAccessTime.dwHighDateTime=0x1d5e38b, ftLastWriteTime.dwLowDateTime=0x4065cb70, ftLastWriteTime.dwHighDateTime=0x1d5e38b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="yndAXana", cAlternateFileName="")) returned 0 [0081.587] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0081.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf0c0) returned 1 [0081.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf0cc) returned 1 [0081.587] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos", nBufferLength=0x105, lpBuffer=0x5bbec6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos", lpFilePart=0x0) returned 0x24 [0081.587] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x5bbeb0c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0081.588] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Videos.txt", nBufferLength=0x105, lpBuffer=0x5bbeb20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Videos.txt", lpFilePart=0x0) returned 0x82 [0081.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf014) returned 1 [0081.588] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Videos.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs\\videos.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x498 [0081.589] GetFileType (hFile=0x498) returned 0x1 [0081.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf010) returned 1 [0081.589] GetFileType (hFile=0x498) returned 0x1 [0081.589] WriteFile (in: hFile=0x498, lpBuffer=0x2761348*, nNumberOfBytesToWrite=0x2cc, lpNumberOfBytesWritten=0x5bbf0ac, lpOverlapped=0x0 | out: lpBuffer=0x2761348*, lpNumberOfBytesWritten=0x5bbf0ac*=0x2cc, lpOverlapped=0x0) returned 1 [0081.590] CloseHandle (hObject=0x498) returned 1 [0081.594] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", nBufferLength=0x105, lpBuffer=0x5bbec38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpFilePart=0x0) returned 0x5b [0081.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf094) returned 1 [0081.594] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup"), fInfoLevelId=0x0, lpFileInformation=0x5bbf110 | out: lpFileInformation=0x5bbf110*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xeebaf170, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xeebaf170, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0081.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf090) returned 1 [0081.594] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", nBufferLength=0x105, lpBuffer=0x5bbec38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpFilePart=0x0) returned 0x5b [0081.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf100) returned 1 [0081.594] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", nBufferLength=0x105, lpBuffer=0x5bbec08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpFilePart=0x0) returned 0x5b [0081.594] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", nBufferLength=0x105, lpBuffer=0x5bbebdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", lpFilePart=0x0) returned 0x5c [0081.594] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", lpFindFileData=0x5bbee28 | out: lpFindFileData=0x5bbee28*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xeebaf170, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xeebaf170, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0081.595] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xeebaf170, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xeebaf170, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.595] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebaf170, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xeebaf170, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0x9cefe300, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x223200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Chrome updaters.exe", cAlternateFileName="CHROME~1.EXE")) returned 1 [0081.595] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0081.595] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0081.595] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0081.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf0c0) returned 1 [0081.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf0cc) returned 1 [0081.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf100) returned 1 [0081.596] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", nBufferLength=0x105, lpBuffer=0x5bbec08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpFilePart=0x0) returned 0x5b [0081.596] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", nBufferLength=0x105, lpBuffer=0x5bbebdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", lpFilePart=0x0) returned 0x5c [0081.596] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", lpFindFileData=0x5bbee28 | out: lpFindFileData=0x5bbee28*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xeebaf170, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xeebaf170, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0081.596] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xeebaf170, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xeebaf170, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.596] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebaf170, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xeebaf170, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0x9cefe300, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x223200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Chrome updaters.exe", cAlternateFileName="CHROME~1.EXE")) returned 1 [0081.596] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0081.596] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0081.597] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0081.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf0c0) returned 1 [0081.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf0cc) returned 1 [0081.597] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", nBufferLength=0x105, lpBuffer=0x5bbec6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpFilePart=0x0) returned 0x5b [0081.597] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x5bbeb0c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0081.597] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Startup.txt", nBufferLength=0x105, lpBuffer=0x5bbeb20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Startup.txt", lpFilePart=0x0) returned 0x83 [0081.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf014) returned 1 [0081.597] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Startup.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs\\startup.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x498 [0081.598] GetFileType (hFile=0x498) returned 0x1 [0081.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf010) returned 1 [0081.598] GetFileType (hFile=0x498) returned 0x1 [0081.598] WriteFile (in: hFile=0x498, lpBuffer=0x2766928*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x5bbf0ac, lpOverlapped=0x0 | out: lpBuffer=0x2766928*, lpNumberOfBytesWritten=0x5bbf0ac*=0x2e, lpOverlapped=0x0) returned 1 [0081.599] CloseHandle (hObject=0x498) returned 1 [0081.600] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads", nBufferLength=0x105, lpBuffer=0x5bbec38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads", lpFilePart=0x0) returned 0x27 [0081.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf094) returned 1 [0081.600] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads"), fInfoLevelId=0x0, lpFileInformation=0x5bbf110 | out: lpFileInformation=0x5bbf110*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0081.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf090) returned 1 [0081.601] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads", nBufferLength=0x105, lpBuffer=0x5bbec38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads", lpFilePart=0x0) returned 0x27 [0081.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf100) returned 1 [0081.601] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads", nBufferLength=0x105, lpBuffer=0x5bbec08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads", lpFilePart=0x0) returned 0x27 [0081.601] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\", nBufferLength=0x105, lpBuffer=0x5bbebdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\", lpFilePart=0x0) returned 0x28 [0081.601] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*", lpFindFileData=0x5bbee28 | out: lpFindFileData=0x5bbee28*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0081.601] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.601] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0081.602] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0081.602] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0081.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf0c0) returned 1 [0081.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf0cc) returned 1 [0081.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf100) returned 1 [0081.602] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads", nBufferLength=0x105, lpBuffer=0x5bbec08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads", lpFilePart=0x0) returned 0x27 [0081.602] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\", nBufferLength=0x105, lpBuffer=0x5bbebdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\", lpFilePart=0x0) returned 0x28 [0081.602] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*", lpFindFileData=0x5bbee28 | out: lpFindFileData=0x5bbee28*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0081.602] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.602] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0081.603] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0081.603] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0081.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf0c0) returned 1 [0081.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf0cc) returned 1 [0081.603] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads", nBufferLength=0x105, lpBuffer=0x5bbec6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads", lpFilePart=0x0) returned 0x27 [0081.603] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x5bbeb0c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0081.603] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Downloads.txt", nBufferLength=0x105, lpBuffer=0x5bbeb20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Downloads.txt", lpFilePart=0x0) returned 0x85 [0081.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf014) returned 1 [0081.604] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Downloads.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs\\downloads.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x498 [0081.705] GetFileType (hFile=0x498) returned 0x1 [0081.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf010) returned 1 [0081.705] GetFileType (hFile=0x498) returned 0x1 [0081.705] WriteFile (in: hFile=0x498, lpBuffer=0x276a9dc*, nNumberOfBytesToWrite=0x1a, lpNumberOfBytesWritten=0x5bbf0ac, lpOverlapped=0x0 | out: lpBuffer=0x276a9dc*, lpNumberOfBytesWritten=0x5bbf0ac*=0x1a, lpOverlapped=0x0) returned 1 [0081.706] CloseHandle (hObject=0x498) returned 1 [0081.707] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Dropbox", nBufferLength=0x105, lpBuffer=0x5bbec38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Dropbox", lpFilePart=0x0) returned 0x25 [0081.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf094) returned 1 [0081.707] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Dropbox" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\dropbox"), fInfoLevelId=0x0, lpFileInformation=0x5bbf110 | out: lpFileInformation=0x5bbf110*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0081.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf090) returned 1 [0081.708] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Dropbox", nBufferLength=0x105, lpBuffer=0x5bbec6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Dropbox", lpFilePart=0x0) returned 0x25 [0081.708] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\OneDrive", nBufferLength=0x105, lpBuffer=0x5bbec38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\OneDrive", lpFilePart=0x0) returned 0x26 [0081.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf094) returned 1 [0081.708] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\OneDrive" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\onedrive"), fInfoLevelId=0x0, lpFileInformation=0x5bbf110 | out: lpFileInformation=0x5bbf110*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0081.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf090) returned 1 [0081.708] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\OneDrive", nBufferLength=0x105, lpBuffer=0x5bbec6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\OneDrive", lpFilePart=0x0) returned 0x26 [0081.708] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x5bbec24, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0081.709] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x5bbec38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x30 [0081.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf094) returned 1 [0081.709] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp"), fInfoLevelId=0x0, lpFileInformation=0x5bbf110 | out: lpFileInformation=0x5bbf110*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf3e40c90, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf3e40c90, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x10000)) returned 1 [0081.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf090) returned 1 [0081.709] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x5bbec24, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0081.710] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x5bbec38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x30 [0081.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf100) returned 1 [0081.710] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x5bbec08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x30 [0081.710] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x5bbebdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x31 [0081.710] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\*", lpFindFileData=0x5bbee28 | out: lpFindFileData=0x5bbee28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf3e40c90, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf3e40c90, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0081.710] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf3e40c90, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf3e40c90, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.711] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x513882c0, ftCreationTime.dwHighDateTime=0x1d5e639, ftLastAccessTime.dwLowDateTime=0xa93da3d0, ftLastAccessTime.dwHighDateTime=0x1d5e25e, ftLastWriteTime.dwLowDateTime=0xa93da3d0, ftLastWriteTime.dwHighDateTime=0x1d5e25e, nFileSizeHigh=0x0, nFileSizeLow=0x33f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="2Z8kQwlSPW.avi", cAlternateFileName="2Z8KQW~1.AVI")) returned 1 [0081.711] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8aa26310, ftCreationTime.dwHighDateTime=0x1d5e304, ftLastAccessTime.dwLowDateTime=0x68df32d0, ftLastAccessTime.dwHighDateTime=0x1d5e575, ftLastWriteTime.dwLowDateTime=0x68df32d0, ftLastWriteTime.dwHighDateTime=0x1d5e575, nFileSizeHigh=0x0, nFileSizeLow=0x1778a, dwReserved0=0x0, dwReserved1=0x0, cFileName="4 gCmsKJ4.odp", cAlternateFileName="4GCMSK~1.ODP")) returned 1 [0081.711] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x88265730, ftCreationTime.dwHighDateTime=0x1d5dc0c, ftLastAccessTime.dwLowDateTime=0xf362d1d0, ftLastAccessTime.dwHighDateTime=0x1d5d992, ftLastWriteTime.dwLowDateTime=0xf362d1d0, ftLastWriteTime.dwHighDateTime=0x1d5d992, nFileSizeHigh=0x0, nFileSizeLow=0x3902, dwReserved0=0x0, dwReserved1=0x0, cFileName="5-au8sTR_DKW.bmp", cAlternateFileName="5-AU8S~1.BMP")) returned 1 [0081.711] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84e753a0, ftCreationTime.dwHighDateTime=0x1d5e5e2, ftLastAccessTime.dwLowDateTime=0x45006620, ftLastAccessTime.dwHighDateTime=0x1d5da5f, ftLastWriteTime.dwLowDateTime=0x45006620, ftLastWriteTime.dwHighDateTime=0x1d5da5f, nFileSizeHigh=0x0, nFileSizeLow=0x350e, dwReserved0=0x0, dwReserved1=0x0, cFileName="57qTz_2cSF05D7BsCcc.pps", cAlternateFileName="57QTZ_~1.PPS")) returned 1 [0081.712] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe0cff6c0, ftCreationTime.dwHighDateTime=0x1d5e062, ftLastAccessTime.dwLowDateTime=0xb986d250, ftLastAccessTime.dwHighDateTime=0x1d5e6d9, ftLastWriteTime.dwLowDateTime=0xb986d250, ftLastWriteTime.dwHighDateTime=0x1d5e6d9, nFileSizeHigh=0x0, nFileSizeLow=0x5964, dwReserved0=0x0, dwReserved1=0x0, cFileName="6o74G.mp3", cAlternateFileName="")) returned 1 [0081.712] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe58ff980, ftCreationTime.dwHighDateTime=0x1d5dee6, ftLastAccessTime.dwLowDateTime=0x73d64b0, ftLastAccessTime.dwHighDateTime=0x1d5dfe0, ftLastWriteTime.dwLowDateTime=0x73d64b0, ftLastWriteTime.dwHighDateTime=0x1d5dfe0, nFileSizeHigh=0x0, nFileSizeLow=0x100fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="7OhdXa3ktL4-VE8Up.mkv", cAlternateFileName="7OHDXA~1.MKV")) returned 1 [0081.712] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf3e40c90, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf3e40c90, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9df274b54410817b3690312b4cb55431", cAlternateFileName="9DF274~1")) returned 1 [0081.712] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a0318e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x6a0318e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xb20126a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeARM.log", cAlternateFileName="")) returned 1 [0081.712] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6be9bb00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x6be9bb00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x6be9bb00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bst449D.tmp", cAlternateFileName="")) returned 1 [0081.713] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5ca50, ftCreationTime.dwHighDateTime=0x1d5d89c, ftLastAccessTime.dwLowDateTime=0x6b882ea0, ftLastAccessTime.dwHighDateTime=0x1d5e729, ftLastWriteTime.dwLowDateTime=0x6b882ea0, ftLastWriteTime.dwHighDateTime=0x1d5e729, nFileSizeHigh=0x0, nFileSizeLow=0x3641, dwReserved0=0x0, dwReserved1=0x0, cFileName="BXPtYk9CKQNZ.bmp", cAlternateFileName="BXPTYK~1.BMP")) returned 1 [0081.713] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0081.713] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7adf8600, ftCreationTime.dwHighDateTime=0x1d5e012, ftLastAccessTime.dwLowDateTime=0xda8116a0, ftLastAccessTime.dwHighDateTime=0x1d5e44f, ftLastWriteTime.dwLowDateTime=0xda8116a0, ftLastWriteTime.dwHighDateTime=0x1d5e44f, nFileSizeHigh=0x0, nFileSizeLow=0x17a7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="d_9fzjXN59RtsG6FF.wav", cAlternateFileName="D_9FZJ~1.WAV")) returned 1 [0081.714] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa53eae00, ftCreationTime.dwHighDateTime=0x1d5e786, ftLastAccessTime.dwLowDateTime=0xb4ad3980, ftLastAccessTime.dwHighDateTime=0x1d5e4e6, ftLastWriteTime.dwLowDateTime=0xb4ad3980, ftLastWriteTime.dwHighDateTime=0x1d5e4e6, nFileSizeHigh=0x0, nFileSizeLow=0x309d, dwReserved0=0x0, dwReserved1=0x0, cFileName="EJsyP17Z.csv", cAlternateFileName="")) returned 1 [0081.714] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb84a230, ftCreationTime.dwHighDateTime=0x1d5de96, ftLastAccessTime.dwLowDateTime=0x91f8d5a0, ftLastAccessTime.dwHighDateTime=0x1d5e49d, ftLastWriteTime.dwLowDateTime=0x91f8d5a0, ftLastWriteTime.dwHighDateTime=0x1d5e49d, nFileSizeHigh=0x0, nFileSizeLow=0x51a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="F1_TNQKi1ckgpfT.docx", cAlternateFileName="F1_TNQ~1.DOC")) returned 1 [0081.714] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33d9ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x33d9ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FXSAPIDebugLogFile.txt", cAlternateFileName="FXSAPI~1.TXT")) returned 1 [0081.714] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1804b30, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf1804b30, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf1804b30, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="gpustats.bx", cAlternateFileName="")) returned 1 [0081.714] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9a5f1ab0, ftCreationTime.dwHighDateTime=0x1d5dbe7, ftLastAccessTime.dwLowDateTime=0x4a85c690, ftLastAccessTime.dwHighDateTime=0x1d5e0f8, ftLastWriteTime.dwLowDateTime=0x4a85c690, ftLastWriteTime.dwHighDateTime=0x1d5e0f8, nFileSizeHigh=0x0, nFileSizeLow=0x273e, dwReserved0=0x0, dwReserved1=0x0, cFileName="hI7dcq.wav", cAlternateFileName="")) returned 1 [0081.715] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0081.715] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x17aa39b0, ftCreationTime.dwHighDateTime=0x1d5d7d7, ftLastAccessTime.dwLowDateTime=0xbc1dbdd0, ftLastAccessTime.dwHighDateTime=0x1d5dc39, ftLastWriteTime.dwLowDateTime=0xbc1dbdd0, ftLastWriteTime.dwHighDateTime=0x1d5dc39, nFileSizeHigh=0x0, nFileSizeLow=0xeaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="jjjiPdyoEp5H.jpg", cAlternateFileName="JJJIPD~1.JPG")) returned 1 [0081.715] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1158a930, ftCreationTime.dwHighDateTime=0x1d5e7f3, ftLastAccessTime.dwLowDateTime=0xebb4dc10, ftLastAccessTime.dwHighDateTime=0x1d5e4c0, ftLastWriteTime.dwLowDateTime=0xebb4dc10, ftLastWriteTime.dwHighDateTime=0x1d5e4c0, nFileSizeHigh=0x0, nFileSizeLow=0x1e98, dwReserved0=0x0, dwReserved1=0x0, cFileName="KnapLok_XqWA.mp3", cAlternateFileName="KNAPLO~1.MP3")) returned 1 [0081.715] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x950b5510, ftCreationTime.dwHighDateTime=0x1d5e295, ftLastAccessTime.dwLowDateTime=0xa3334ea0, ftLastAccessTime.dwHighDateTime=0x1d5d8d5, ftLastWriteTime.dwLowDateTime=0xa3334ea0, ftLastWriteTime.dwHighDateTime=0x1d5d8d5, nFileSizeHigh=0x0, nFileSizeLow=0xad0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="LcuZSRQ81m.bmp", cAlternateFileName="LCUZSR~1.BMP")) returned 1 [0081.715] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c67fd30, ftCreationTime.dwHighDateTime=0x1d5dd11, ftLastAccessTime.dwLowDateTime=0x903b17a0, ftLastAccessTime.dwHighDateTime=0x1d5d93a, ftLastWriteTime.dwLowDateTime=0x903b17a0, ftLastWriteTime.dwHighDateTime=0x1d5d93a, nFileSizeHigh=0x0, nFileSizeLow=0x1258, dwReserved0=0x0, dwReserved1=0x0, cFileName="LGBlh.png", cAlternateFileName="")) returned 1 [0081.715] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef4c66b0, ftCreationTime.dwHighDateTime=0x1d5da78, ftLastAccessTime.dwLowDateTime=0x85fc9b20, ftLastAccessTime.dwHighDateTime=0x1d5d7b3, ftLastWriteTime.dwLowDateTime=0x85fc9b20, ftLastWriteTime.dwHighDateTime=0x1d5d7b3, nFileSizeHigh=0x0, nFileSizeLow=0x9a51, dwReserved0=0x0, dwReserved1=0x0, cFileName="lPhqwdd.mkv", cAlternateFileName="")) returned 1 [0081.716] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x67ed1350, ftCreationTime.dwHighDateTime=0x1d5dcb1, ftLastAccessTime.dwLowDateTime=0x5b143350, ftLastAccessTime.dwHighDateTime=0x1d5e000, ftLastWriteTime.dwLowDateTime=0x5b143350, ftLastWriteTime.dwHighDateTime=0x1d5e000, nFileSizeHigh=0x0, nFileSizeLow=0x274d, dwReserved0=0x0, dwReserved1=0x0, cFileName="lUUqXpadmhf.gif", cAlternateFileName="LUUQXP~1.GIF")) returned 1 [0081.716] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda42f130, ftCreationTime.dwHighDateTime=0x1d5d893, ftLastAccessTime.dwLowDateTime=0x95a0280, ftLastAccessTime.dwHighDateTime=0x1d5e2a6, ftLastWriteTime.dwLowDateTime=0x95a0280, ftLastWriteTime.dwHighDateTime=0x1d5e2a6, nFileSizeHigh=0x0, nFileSizeLow=0x17a2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="mVNMnSYtuQS.avi", cAlternateFileName="MVNMNS~1.AVI")) returned 1 [0081.716] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1a20dc80, ftCreationTime.dwHighDateTime=0x1d5e2ef, ftLastAccessTime.dwLowDateTime=0x4320ae30, ftLastAccessTime.dwHighDateTime=0x1d5daa2, ftLastWriteTime.dwLowDateTime=0x4320ae30, ftLastWriteTime.dwHighDateTime=0x1d5daa2, nFileSizeHigh=0x0, nFileSizeLow=0x8b09, dwReserved0=0x0, dwReserved1=0x0, cFileName="n3GtYqkuzgbfFej.bmp", cAlternateFileName="N3GTYQ~1.BMP")) returned 1 [0081.716] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42d5aff0, ftCreationTime.dwHighDateTime=0x1d5e4bd, ftLastAccessTime.dwLowDateTime=0xa3223490, ftLastAccessTime.dwHighDateTime=0x1d5de9c, ftLastWriteTime.dwLowDateTime=0xa3223490, ftLastWriteTime.dwHighDateTime=0x1d5de9c, nFileSizeHigh=0x0, nFileSizeLow=0x17b1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NQd6iEWAJJNDx9.swf", cAlternateFileName="NQD6IE~1.SWF")) returned 1 [0081.716] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x118b2650, ftCreationTime.dwHighDateTime=0x1d5ddec, ftLastAccessTime.dwLowDateTime=0x8c619c60, ftLastAccessTime.dwHighDateTime=0x1d5df2c, ftLastWriteTime.dwLowDateTime=0x8c619c60, ftLastWriteTime.dwHighDateTime=0x1d5df2c, nFileSizeHigh=0x0, nFileSizeLow=0x6d4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="pf8VR.doc", cAlternateFileName="")) returned 1 [0081.716] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xca0072f0, ftCreationTime.dwHighDateTime=0x1d5e43e, ftLastAccessTime.dwLowDateTime=0x488f7650, ftLastAccessTime.dwHighDateTime=0x1d5e702, ftLastWriteTime.dwLowDateTime=0x488f7650, ftLastWriteTime.dwHighDateTime=0x1d5e702, nFileSizeHigh=0x0, nFileSizeLow=0x1d2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="puMUyOkInN5vYu.bmp", cAlternateFileName="PUMUYO~1.BMP")) returned 1 [0081.717] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfb72aa0, ftCreationTime.dwHighDateTime=0x1d5e7a5, ftLastAccessTime.dwLowDateTime=0x7ff5690, ftLastAccessTime.dwHighDateTime=0x1d5d808, ftLastWriteTime.dwLowDateTime=0x7ff5690, ftLastWriteTime.dwHighDateTime=0x1d5d808, nFileSizeHigh=0x0, nFileSizeLow=0x6e48, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGjKRO.bmp", cAlternateFileName="")) returned 1 [0081.717] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa89f0ac0, ftCreationTime.dwHighDateTime=0x1d5e6fc, ftLastAccessTime.dwLowDateTime=0xe0bf87e0, ftLastAccessTime.dwHighDateTime=0x1d5e3d7, ftLastWriteTime.dwLowDateTime=0xe0bf87e0, ftLastWriteTime.dwHighDateTime=0x1d5e3d7, nFileSizeHigh=0x0, nFileSizeLow=0x28a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="rukJ2ki9DOoDHhK.mp3", cAlternateFileName="RUKJ2K~1.MP3")) returned 1 [0081.717] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0081.717] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x31f5580, ftCreationTime.dwHighDateTime=0x1d5e294, ftLastAccessTime.dwLowDateTime=0xd0dd62b0, ftLastAccessTime.dwHighDateTime=0x1d5dd66, ftLastWriteTime.dwLowDateTime=0xd0dd62b0, ftLastWriteTime.dwHighDateTime=0x1d5dd66, nFileSizeHigh=0x0, nFileSizeLow=0x14645, dwReserved0=0x0, dwReserved1=0x0, cFileName="TgReyANn2kjAJUG9.png", cAlternateFileName="TGREYA~1.PNG")) returned 1 [0081.717] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x65818490, ftCreationTime.dwHighDateTime=0x1d5e493, ftLastAccessTime.dwLowDateTime=0x6af43ce0, ftLastAccessTime.dwHighDateTime=0x1d5de32, ftLastWriteTime.dwLowDateTime=0x6af43ce0, ftLastWriteTime.dwHighDateTime=0x1d5de32, nFileSizeHigh=0x0, nFileSizeLow=0xc74a, dwReserved0=0x0, dwReserved1=0x0, cFileName="tkAF 9Ybmddq50wDQaF.wav", cAlternateFileName="TKAF9Y~1.WAV")) returned 1 [0081.718] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb9717ff0, ftCreationTime.dwHighDateTime=0x1d5dcf1, ftLastAccessTime.dwLowDateTime=0xda373160, ftLastAccessTime.dwHighDateTime=0x1d5dfe6, ftLastWriteTime.dwLowDateTime=0xda373160, ftLastWriteTime.dwHighDateTime=0x1d5dfe6, nFileSizeHigh=0x0, nFileSizeLow=0x7527, dwReserved0=0x0, dwReserved1=0x0, cFileName="tzH31l45.jpg", cAlternateFileName="")) returned 1 [0081.718] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x92470b00, ftCreationTime.dwHighDateTime=0x1d5da3c, ftLastAccessTime.dwLowDateTime=0x36dca210, ftLastAccessTime.dwHighDateTime=0x1d5e2fd, ftLastWriteTime.dwLowDateTime=0x36dca210, ftLastWriteTime.dwHighDateTime=0x1d5e2fd, nFileSizeHigh=0x0, nFileSizeLow=0xbb08, dwReserved0=0x0, dwReserved1=0x0, cFileName="US-VXYmW_QdpRyP4RM1Z.xls", cAlternateFileName="US-VXY~1.XLS")) returned 1 [0081.718] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x89aadc0, ftCreationTime.dwHighDateTime=0x1d5d86c, ftLastAccessTime.dwLowDateTime=0xa9de8de0, ftLastAccessTime.dwHighDateTime=0x1d5e402, ftLastWriteTime.dwLowDateTime=0xa9de8de0, ftLastWriteTime.dwHighDateTime=0x1d5e402, nFileSizeHigh=0x0, nFileSizeLow=0x3c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="vor0Oy7pcXjnQD6PP.swf", cAlternateFileName="VOR0OY~1.SWF")) returned 1 [0081.718] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb51728d0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xb51728d0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xb51728d0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPDNSE", cAlternateFileName="")) returned 1 [0081.718] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2baaf60, ftCreationTime.dwHighDateTime=0x1d5ddf6, ftLastAccessTime.dwLowDateTime=0x75b2e5d0, ftLastAccessTime.dwHighDateTime=0x1d5de0c, ftLastWriteTime.dwLowDateTime=0x75b2e5d0, ftLastWriteTime.dwHighDateTime=0x1d5de0c, nFileSizeHigh=0x0, nFileSizeLow=0x7305, dwReserved0=0x0, dwReserved1=0x0, cFileName="wZuI0X8AKAWESBdA.avi", cAlternateFileName="WZUI0X~1.AVI")) returned 1 [0081.718] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcbf8a4a0, ftCreationTime.dwHighDateTime=0x1d5dc97, ftLastAccessTime.dwLowDateTime=0x407045a0, ftLastAccessTime.dwHighDateTime=0x1d5e331, ftLastWriteTime.dwLowDateTime=0x407045a0, ftLastWriteTime.dwHighDateTime=0x1d5e331, nFileSizeHigh=0x0, nFileSizeLow=0x18006, dwReserved0=0x0, dwReserved1=0x0, cFileName="YsijQxuL.wav", cAlternateFileName="")) returned 1 [0081.719] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3c8b92d0, ftCreationTime.dwHighDateTime=0x1d5e51d, ftLastAccessTime.dwLowDateTime=0x3f3caac0, ftLastAccessTime.dwHighDateTime=0x1d5dca6, ftLastWriteTime.dwLowDateTime=0x3f3caac0, ftLastWriteTime.dwHighDateTime=0x1d5dca6, nFileSizeHigh=0x0, nFileSizeLow=0xfd1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="zQJQyNI.pps", cAlternateFileName="")) returned 1 [0081.719] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3c8b92d0, ftCreationTime.dwHighDateTime=0x1d5e51d, ftLastAccessTime.dwLowDateTime=0x3f3caac0, ftLastAccessTime.dwHighDateTime=0x1d5dca6, ftLastWriteTime.dwLowDateTime=0x3f3caac0, ftLastWriteTime.dwHighDateTime=0x1d5dca6, nFileSizeHigh=0x0, nFileSizeLow=0xfd1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="zQJQyNI.pps", cAlternateFileName="")) returned 0 [0081.719] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0081.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf0c0) returned 1 [0081.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf0cc) returned 1 [0081.719] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\.", nBufferLength=0x105, lpBuffer=0x5bbebc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431", lpFilePart=0x0) returned 0x51 [0081.719] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431", nBufferLength=0x105, lpBuffer=0x5bbebf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431", lpFilePart=0x0) returned 0x51 [0081.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf050) returned 1 [0081.719] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431"), fInfoLevelId=0x0, lpFileInformation=0x5bbf0cc | out: lpFileInformation=0x5bbf0cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf3e40c90, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf3e40c90, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0081.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf04c) returned 1 [0081.719] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431", nBufferLength=0x105, lpBuffer=0x5bbebf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431", lpFilePart=0x0) returned 0x51 [0081.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf0bc) returned 1 [0081.720] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431", nBufferLength=0x105, lpBuffer=0x5bbebc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431", lpFilePart=0x0) returned 0x51 [0081.720] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\", nBufferLength=0x105, lpBuffer=0x5bbeb98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\", lpFilePart=0x0) returned 0x52 [0081.720] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\*", lpFindFileData=0x5bbede4 | out: lpFindFileData=0x5bbede4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf3e40c90, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf3e40c90, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0081.720] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf3e40c90, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf3e40c90, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.720] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf5067450, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf5067450, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ec3947efc19179a8010c6bae37caac89", cAlternateFileName="EC3947~1")) returned 1 [0081.721] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0081.721] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0081.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf07c) returned 1 [0081.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf088) returned 1 [0081.721] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\.", nBufferLength=0x105, lpBuffer=0x5bbeb7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", lpFilePart=0x0) returned 0x72 [0081.721] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", nBufferLength=0x105, lpBuffer=0x5bbebb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", lpFilePart=0x0) returned 0x72 [0081.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf00c) returned 1 [0081.721] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89"), fInfoLevelId=0x0, lpFileInformation=0x5bbf088 | out: lpFileInformation=0x5bbf088*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf5067450, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf5067450, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0081.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf008) returned 1 [0081.721] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", nBufferLength=0x105, lpBuffer=0x5bbebb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", lpFilePart=0x0) returned 0x72 [0081.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf078) returned 1 [0081.721] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", nBufferLength=0x105, lpBuffer=0x5bbeb80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", lpFilePart=0x0) returned 0x72 [0081.721] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\", nBufferLength=0x105, lpBuffer=0x5bbeb54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\", lpFilePart=0x0) returned 0x73 [0081.721] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\*", lpFindFileData=0x5bbeda0 | out: lpFindFileData=0x5bbeda0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf5067450, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf5067450, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0081.722] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf5067450, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf5067450, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.722] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf5067450, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf66de3f0, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf66de3f0, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dirs", cAlternateFileName="")) returned 1 [0081.722] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0081.722] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0081.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf038) returned 1 [0081.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf044) returned 1 [0081.722] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\.", nBufferLength=0x105, lpBuffer=0x5bbeb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs", lpFilePart=0x0) returned 0x77 [0081.722] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs", nBufferLength=0x105, lpBuffer=0x5bbeb6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs", lpFilePart=0x0) returned 0x77 [0081.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbefc8) returned 1 [0081.722] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs"), fInfoLevelId=0x0, lpFileInformation=0x5bbf044 | out: lpFileInformation=0x5bbf044*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf5067450, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf66de3f0, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf66de3f0, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0081.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbefc4) returned 1 [0081.723] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs", nBufferLength=0x105, lpBuffer=0x5bbeb6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs", lpFilePart=0x0) returned 0x77 [0081.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf034) returned 1 [0081.723] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs", nBufferLength=0x105, lpBuffer=0x5bbeb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs", lpFilePart=0x0) returned 0x77 [0081.723] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\", nBufferLength=0x105, lpBuffer=0x5bbeb10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\", lpFilePart=0x0) returned 0x78 [0081.723] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\*", lpFindFileData=0x5bbed5c | out: lpFindFileData=0x5bbed5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf5067450, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf66de3f0, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf66de3f0, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0081.723] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf5067450, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf66de3f0, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf66de3f0, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.723] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf59a0990, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf59a0990, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf59a0990, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x3ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.txt", cAlternateFileName="")) returned 1 [0081.723] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5e896f0, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf5e896f0, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf5e896f0, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x559, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents.txt", cAlternateFileName="DOCUME~1.TXT")) returned 1 [0081.724] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf65f9bb0, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf65f9bb0, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf66de3f0, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads.txt", cAlternateFileName="DOWNLO~1.TXT")) returned 1 [0081.724] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5eaf850, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf5eaf850, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf5eaf850, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x31f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures.txt", cAlternateFileName="")) returned 1 [0081.724] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf65d3a50, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf65d3a50, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf65d3a50, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Startup.txt", cAlternateFileName="")) returned 1 [0081.724] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf65d3a50, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf65d3a50, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf65d3a50, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos.txt", cAlternateFileName="")) returned 1 [0081.724] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf65d3a50, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf65d3a50, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf65d3a50, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos.txt", cAlternateFileName="")) returned 0 [0081.724] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0081.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbeff4) returned 1 [0081.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf000) returned 1 [0081.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf034) returned 1 [0081.725] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs", nBufferLength=0x105, lpBuffer=0x5bbeb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs", lpFilePart=0x0) returned 0x77 [0081.725] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\", nBufferLength=0x105, lpBuffer=0x5bbeb10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\", lpFilePart=0x0) returned 0x78 [0081.725] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\*", lpFindFileData=0x5bbed5c | out: lpFindFileData=0x5bbed5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf5067450, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf66de3f0, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf66de3f0, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0081.725] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf5067450, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf66de3f0, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf66de3f0, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.725] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf59a0990, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf59a0990, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf59a0990, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x3ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.txt", cAlternateFileName="")) returned 1 [0081.725] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5e896f0, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf5e896f0, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf5e896f0, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x559, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents.txt", cAlternateFileName="DOCUME~1.TXT")) returned 1 [0081.725] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf65f9bb0, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf65f9bb0, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf66de3f0, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads.txt", cAlternateFileName="DOWNLO~1.TXT")) returned 1 [0081.726] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5eaf850, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf5eaf850, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf5eaf850, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x31f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures.txt", cAlternateFileName="")) returned 1 [0081.726] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf65d3a50, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf65d3a50, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf65d3a50, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Startup.txt", cAlternateFileName="")) returned 1 [0081.726] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf65d3a50, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf65d3a50, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf65d3a50, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos.txt", cAlternateFileName="")) returned 1 [0081.726] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0081.726] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0081.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbeff4) returned 1 [0081.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf000) returned 1 [0081.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf078) returned 1 [0081.727] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", nBufferLength=0x105, lpBuffer=0x5bbeb80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", lpFilePart=0x0) returned 0x72 [0081.727] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\", nBufferLength=0x105, lpBuffer=0x5bbeb54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\", lpFilePart=0x0) returned 0x73 [0081.727] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\*", lpFindFileData=0x5bbeda0 | out: lpFindFileData=0x5bbeda0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf5067450, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf5067450, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0081.727] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf5067450, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf5067450, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.727] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf5067450, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf66de3f0, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf66de3f0, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dirs", cAlternateFileName="")) returned 1 [0081.727] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf5067450, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf66de3f0, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf66de3f0, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dirs", cAlternateFileName="")) returned 0 [0081.727] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0081.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf038) returned 1 [0081.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf044) returned 1 [0081.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf0bc) returned 1 [0081.728] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431", nBufferLength=0x105, lpBuffer=0x5bbebc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431", lpFilePart=0x0) returned 0x51 [0081.728] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\", nBufferLength=0x105, lpBuffer=0x5bbeb98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\", lpFilePart=0x0) returned 0x52 [0081.728] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\*", lpFindFileData=0x5bbede4 | out: lpFindFileData=0x5bbede4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf3e40c90, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf3e40c90, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0081.728] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf3e40c90, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf3e40c90, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.728] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf5067450, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf5067450, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ec3947efc19179a8010c6bae37caac89", cAlternateFileName="EC3947~1")) returned 1 [0082.036] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf5067450, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf5067450, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ec3947efc19179a8010c6bae37caac89", cAlternateFileName="EC3947~1")) returned 0 [0082.037] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0082.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf07c) returned 1 [0082.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf088) returned 1 [0082.037] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\.", nBufferLength=0x105, lpBuffer=0x5bbebc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies", lpFilePart=0x0) returned 0x38 [0082.037] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies", nBufferLength=0x105, lpBuffer=0x5bbebf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies", lpFilePart=0x0) returned 0x38 [0082.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf050) returned 1 [0082.037] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cookies"), fInfoLevelId=0x0, lpFileInformation=0x5bbf0cc | out: lpFileInformation=0x5bbf0cc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0082.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf04c) returned 1 [0082.203] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies", nBufferLength=0x105, lpBuffer=0x5bbebf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies", lpFilePart=0x0) returned 0x38 [0082.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf0bc) returned 1 [0082.207] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies", nBufferLength=0x105, lpBuffer=0x5bbebc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies", lpFilePart=0x0) returned 0x38 [0082.207] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\", nBufferLength=0x105, lpBuffer=0x5bbeb98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\", lpFilePart=0x0) returned 0x39 [0082.207] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\*", lpFindFileData=0x5bbede4 | out: lpFindFileData=0x5bbede4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0082.208] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.208] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0082.208] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0082.208] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0082.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf07c) returned 1 [0082.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf088) returned 1 [0082.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf0bc) returned 1 [0082.208] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies", nBufferLength=0x105, lpBuffer=0x5bbebc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies", lpFilePart=0x0) returned 0x38 [0082.208] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\", nBufferLength=0x105, lpBuffer=0x5bbeb98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\", lpFilePart=0x0) returned 0x39 [0082.208] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\*", lpFindFileData=0x5bbede4 | out: lpFindFileData=0x5bbede4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0082.209] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.209] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0082.209] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0082.209] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0082.209] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf07c) returned 1 [0082.209] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf088) returned 1 [0082.209] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\.", nBufferLength=0x105, lpBuffer=0x5bbebc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History", lpFilePart=0x0) returned 0x38 [0082.210] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History", nBufferLength=0x105, lpBuffer=0x5bbebf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History", lpFilePart=0x0) returned 0x38 [0082.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf050) returned 1 [0082.210] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history"), fInfoLevelId=0x0, lpFileInformation=0x5bbf0cc | out: lpFileInformation=0x5bbf0cc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0082.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf04c) returned 1 [0082.337] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History", nBufferLength=0x105, lpBuffer=0x5bbebf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History", lpFilePart=0x0) returned 0x38 [0082.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf0bc) returned 1 [0082.337] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History", nBufferLength=0x105, lpBuffer=0x5bbebc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History", lpFilePart=0x0) returned 0x38 [0082.338] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\", nBufferLength=0x105, lpBuffer=0x5bbeb98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\", lpFilePart=0x0) returned 0x39 [0082.338] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\*", lpFindFileData=0x5bbede4 | out: lpFindFileData=0x5bbede4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0082.338] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.338] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1 [0082.338] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0082.338] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0082.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf07c) returned 1 [0082.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf088) returned 1 [0082.339] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\.", nBufferLength=0x105, lpBuffer=0x5bbeb7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5", lpFilePart=0x0) returned 0x44 [0082.339] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5", nBufferLength=0x105, lpBuffer=0x5bbebb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5", lpFilePart=0x0) returned 0x44 [0082.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf00c) returned 1 [0082.339] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5"), fInfoLevelId=0x0, lpFileInformation=0x5bbf088 | out: lpFileInformation=0x5bbf088*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0082.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf008) returned 1 [0082.339] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5", nBufferLength=0x105, lpBuffer=0x5bbebb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5", lpFilePart=0x0) returned 0x44 [0082.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf078) returned 1 [0082.339] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5", nBufferLength=0x105, lpBuffer=0x5bbeb80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5", lpFilePart=0x0) returned 0x44 [0082.339] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\", nBufferLength=0x105, lpBuffer=0x5bbeb54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\", lpFilePart=0x0) returned 0x45 [0082.339] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\*", lpFindFileData=0x5bbeda0 | out: lpFindFileData=0x5bbeda0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0082.340] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.340] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9824200, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0082.340] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0082.340] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0082.340] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0082.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf038) returned 1 [0082.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf044) returned 1 [0082.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf078) returned 1 [0082.340] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5", nBufferLength=0x105, lpBuffer=0x5bbeb80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5", lpFilePart=0x0) returned 0x44 [0082.340] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\", nBufferLength=0x105, lpBuffer=0x5bbeb54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\", lpFilePart=0x0) returned 0x45 [0082.341] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\*", lpFindFileData=0x5bbeda0 | out: lpFindFileData=0x5bbeda0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0082.341] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.341] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9824200, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0082.341] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0082.342] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0082.342] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0082.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf038) returned 1 [0082.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf044) returned 1 [0082.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf0bc) returned 1 [0082.342] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History", nBufferLength=0x105, lpBuffer=0x5bbebc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History", lpFilePart=0x0) returned 0x38 [0082.342] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\", nBufferLength=0x105, lpBuffer=0x5bbeb98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\", lpFilePart=0x0) returned 0x39 [0082.342] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\*", lpFindFileData=0x5bbede4 | out: lpFindFileData=0x5bbede4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0082.342] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.342] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1 [0082.343] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 0 [0082.343] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0082.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf07c) returned 1 [0082.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf088) returned 1 [0082.343] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\.", nBufferLength=0x105, lpBuffer=0x5bbebc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files", lpFilePart=0x0) returned 0x49 [0082.343] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files", nBufferLength=0x105, lpBuffer=0x5bbebf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files", lpFilePart=0x0) returned 0x49 [0082.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf050) returned 1 [0082.343] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files"), fInfoLevelId=0x0, lpFileInformation=0x5bbf0cc | out: lpFileInformation=0x5bbf0cc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0082.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf04c) returned 1 [0082.401] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files", nBufferLength=0x105, lpBuffer=0x5bbebf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files", lpFilePart=0x0) returned 0x49 [0082.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf0bc) returned 1 [0082.401] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files", nBufferLength=0x105, lpBuffer=0x5bbebc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files", lpFilePart=0x0) returned 0x49 [0082.401] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\", nBufferLength=0x105, lpBuffer=0x5bbeb98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\", lpFilePart=0x0) returned 0x4a [0082.401] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\*", lpFindFileData=0x5bbede4 | out: lpFindFileData=0x5bbede4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0082.401] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.401] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 1 [0082.402] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0082.402] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0082.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf07c) returned 1 [0082.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf088) returned 1 [0082.402] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\.", nBufferLength=0x105, lpBuffer=0x5bbeb7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5", lpFilePart=0x0) returned 0x55 [0082.402] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5", nBufferLength=0x105, lpBuffer=0x5bbebb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5", lpFilePart=0x0) returned 0x55 [0082.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf00c) returned 1 [0082.402] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5"), fInfoLevelId=0x0, lpFileInformation=0x5bbf088 | out: lpFileInformation=0x5bbf088*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0082.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf008) returned 1 [0082.402] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5", nBufferLength=0x105, lpBuffer=0x5bbebb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5", lpFilePart=0x0) returned 0x55 [0082.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf078) returned 1 [0082.402] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5", nBufferLength=0x105, lpBuffer=0x5bbeb80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5", lpFilePart=0x0) returned 0x55 [0082.403] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\", nBufferLength=0x105, lpBuffer=0x5bbeb54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\", lpFilePart=0x0) returned 0x56 [0082.403] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\*", lpFindFileData=0x5bbeda0 | out: lpFindFileData=0x5bbeda0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0082.403] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.403] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="03J4UQW0", cAlternateFileName="")) returned 1 [0082.403] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0082.403] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0082.404] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KETAJP6D", cAlternateFileName="")) returned 1 [0082.404] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VB18B0KB", cAlternateFileName="")) returned 1 [0082.404] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XT1RPYG9", cAlternateFileName="")) returned 1 [0082.404] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0082.404] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0082.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf038) returned 1 [0082.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf044) returned 1 [0082.404] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\.", nBufferLength=0x105, lpBuffer=0x5bbeb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0", lpFilePart=0x0) returned 0x5e [0082.404] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0", nBufferLength=0x105, lpBuffer=0x5bbeb6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0", lpFilePart=0x0) returned 0x5e [0082.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbefc8) returned 1 [0082.404] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\03j4uqw0"), fInfoLevelId=0x0, lpFileInformation=0x5bbf044 | out: lpFileInformation=0x5bbf044*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0082.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbefc4) returned 1 [0082.988] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0", nBufferLength=0x105, lpBuffer=0x5bbeb6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0", lpFilePart=0x0) returned 0x5e [0082.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf034) returned 1 [0082.988] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0", nBufferLength=0x105, lpBuffer=0x5bbeb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0", lpFilePart=0x0) returned 0x5e [0082.988] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\", nBufferLength=0x105, lpBuffer=0x5bbeb10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\", lpFilePart=0x0) returned 0x5f [0082.988] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\*", lpFindFileData=0x5bbed5c | out: lpFindFileData=0x5bbed5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0082.989] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.989] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0082.989] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0082.989] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0082.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbeff4) returned 1 [0082.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf000) returned 1 [0082.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf034) returned 1 [0082.990] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0", nBufferLength=0x105, lpBuffer=0x5bbeb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0", lpFilePart=0x0) returned 0x5e [0082.990] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\", nBufferLength=0x105, lpBuffer=0x5bbeb10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\", lpFilePart=0x0) returned 0x5f [0082.990] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\*", lpFindFileData=0x5bbed5c | out: lpFindFileData=0x5bbed5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0082.990] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.990] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0082.990] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0082.991] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0082.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbeff4) returned 1 [0082.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf000) returned 1 [0082.991] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\.", nBufferLength=0x105, lpBuffer=0x5bbeb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D", lpFilePart=0x0) returned 0x5e [0082.991] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D", nBufferLength=0x105, lpBuffer=0x5bbeb6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D", lpFilePart=0x0) returned 0x5e [0082.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbefc8) returned 1 [0082.991] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\ketajp6d"), fInfoLevelId=0x0, lpFileInformation=0x5bbf044 | out: lpFileInformation=0x5bbf044*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0082.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbefc4) returned 1 [0082.992] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D", nBufferLength=0x105, lpBuffer=0x5bbeb6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D", lpFilePart=0x0) returned 0x5e [0082.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf034) returned 1 [0082.992] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D", nBufferLength=0x105, lpBuffer=0x5bbeb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D", lpFilePart=0x0) returned 0x5e [0082.993] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\", nBufferLength=0x105, lpBuffer=0x5bbeb10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\", lpFilePart=0x0) returned 0x5f [0082.993] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\*", lpFindFileData=0x5bbed5c | out: lpFindFileData=0x5bbed5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0082.993] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.993] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0082.993] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0082.993] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0082.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbeff4) returned 1 [0082.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf000) returned 1 [0082.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf034) returned 1 [0082.994] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D", nBufferLength=0x105, lpBuffer=0x5bbeb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D", lpFilePart=0x0) returned 0x5e [0082.994] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\", nBufferLength=0x105, lpBuffer=0x5bbeb10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\", lpFilePart=0x0) returned 0x5f [0082.994] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\*", lpFindFileData=0x5bbed5c | out: lpFindFileData=0x5bbed5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0082.994] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.995] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0082.995] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0082.995] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0082.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbeff4) returned 1 [0082.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf000) returned 1 [0082.995] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\.", nBufferLength=0x105, lpBuffer=0x5bbeb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB", lpFilePart=0x0) returned 0x5e [0082.995] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB", nBufferLength=0x105, lpBuffer=0x5bbeb6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB", lpFilePart=0x0) returned 0x5e [0082.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbefc8) returned 1 [0082.995] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\vb18b0kb"), fInfoLevelId=0x0, lpFileInformation=0x5bbf044 | out: lpFileInformation=0x5bbf044*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0082.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbefc4) returned 1 [0082.996] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB", nBufferLength=0x105, lpBuffer=0x5bbeb6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB", lpFilePart=0x0) returned 0x5e [0082.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf034) returned 1 [0082.996] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB", nBufferLength=0x105, lpBuffer=0x5bbeb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB", lpFilePart=0x0) returned 0x5e [0082.996] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\", nBufferLength=0x105, lpBuffer=0x5bbeb10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\", lpFilePart=0x0) returned 0x5f [0082.996] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\*", lpFindFileData=0x5bbed5c | out: lpFindFileData=0x5bbed5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0082.996] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.997] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0082.997] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0082.997] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0082.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbeff4) returned 1 [0082.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf000) returned 1 [0082.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf034) returned 1 [0082.997] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB", nBufferLength=0x105, lpBuffer=0x5bbeb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB", lpFilePart=0x0) returned 0x5e [0082.997] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\", nBufferLength=0x105, lpBuffer=0x5bbeb10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\", lpFilePart=0x0) returned 0x5f [0082.997] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\*", lpFindFileData=0x5bbed5c | out: lpFindFileData=0x5bbed5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0082.998] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.998] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0082.998] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0082.998] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0082.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbeff4) returned 1 [0082.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf000) returned 1 [0082.998] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\.", nBufferLength=0x105, lpBuffer=0x5bbeb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9", lpFilePart=0x0) returned 0x5e [0082.998] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9", nBufferLength=0x105, lpBuffer=0x5bbeb6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9", lpFilePart=0x0) returned 0x5e [0082.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbefc8) returned 1 [0082.999] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\xt1rpyg9"), fInfoLevelId=0x0, lpFileInformation=0x5bbf044 | out: lpFileInformation=0x5bbf044*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0083.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbefc4) returned 1 [0083.285] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9", nBufferLength=0x105, lpBuffer=0x5bbeb6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9", lpFilePart=0x0) returned 0x5e [0083.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf034) returned 1 [0083.285] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9", nBufferLength=0x105, lpBuffer=0x5bbeb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9", lpFilePart=0x0) returned 0x5e [0083.285] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\", nBufferLength=0x105, lpBuffer=0x5bbeb10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\", lpFilePart=0x0) returned 0x5f [0083.286] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\*", lpFindFileData=0x5bbed5c | out: lpFindFileData=0x5bbed5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0083.286] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.286] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0083.286] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0083.286] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0083.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbeff4) returned 1 [0083.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf000) returned 1 [0083.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf034) returned 1 [0083.286] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9", nBufferLength=0x105, lpBuffer=0x5bbeb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9", lpFilePart=0x0) returned 0x5e [0083.287] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\", nBufferLength=0x105, lpBuffer=0x5bbeb10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\", lpFilePart=0x0) returned 0x5f [0083.287] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\*", lpFindFileData=0x5bbed5c | out: lpFindFileData=0x5bbed5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0083.287] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.287] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0083.287] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbed6c | out: lpFindFileData=0x5bbed6c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0083.287] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0083.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbeff4) returned 1 [0083.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf000) returned 1 [0083.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf078) returned 1 [0083.287] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5", nBufferLength=0x105, lpBuffer=0x5bbeb80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5", lpFilePart=0x0) returned 0x55 [0083.288] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\", nBufferLength=0x105, lpBuffer=0x5bbeb54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\", lpFilePart=0x0) returned 0x56 [0083.288] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\*", lpFindFileData=0x5bbeda0 | out: lpFindFileData=0x5bbeda0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0083.288] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.288] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="03J4UQW0", cAlternateFileName="")) returned 1 [0083.403] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0083.403] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0083.404] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KETAJP6D", cAlternateFileName="")) returned 1 [0083.404] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VB18B0KB", cAlternateFileName="")) returned 1 [0083.404] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XT1RPYG9", cAlternateFileName="")) returned 1 [0083.404] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedb0 | out: lpFindFileData=0x5bbedb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XT1RPYG9", cAlternateFileName="")) returned 0 [0083.405] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0083.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf038) returned 1 [0083.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf044) returned 1 [0083.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf0bc) returned 1 [0083.405] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files", nBufferLength=0x105, lpBuffer=0x5bbebc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files", lpFilePart=0x0) returned 0x49 [0083.405] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\", nBufferLength=0x105, lpBuffer=0x5bbeb98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\", lpFilePart=0x0) returned 0x4a [0083.405] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\*", lpFindFileData=0x5bbede4 | out: lpFindFileData=0x5bbede4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0083.406] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.406] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 1 [0083.406] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 0 [0083.406] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0083.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf07c) returned 1 [0083.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf088) returned 1 [0083.407] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE\\.", nBufferLength=0x105, lpBuffer=0x5bbebc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE", lpFilePart=0x0) returned 0x37 [0083.407] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE", nBufferLength=0x105, lpBuffer=0x5bbebf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE", lpFilePart=0x0) returned 0x37 [0083.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf050) returned 1 [0083.407] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\wpdnse"), fInfoLevelId=0x0, lpFileInformation=0x5bbf0cc | out: lpFileInformation=0x5bbf0cc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb51728d0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xb51728d0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xb51728d0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0083.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf04c) returned 1 [0083.408] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE", nBufferLength=0x105, lpBuffer=0x5bbebf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE", lpFilePart=0x0) returned 0x37 [0083.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf0bc) returned 1 [0083.409] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE", nBufferLength=0x105, lpBuffer=0x5bbebc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE", lpFilePart=0x0) returned 0x37 [0083.409] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE\\", nBufferLength=0x105, lpBuffer=0x5bbeb98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE\\", lpFilePart=0x0) returned 0x38 [0083.409] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE\\*", lpFindFileData=0x5bbede4 | out: lpFindFileData=0x5bbede4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb51728d0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xb51728d0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xb51728d0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0083.409] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb51728d0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xb51728d0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xb51728d0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.409] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb51728d0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xb51728d0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xb51728d0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0083.409] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0083.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf07c) returned 1 [0083.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf088) returned 1 [0083.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf0bc) returned 1 [0083.410] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE", nBufferLength=0x105, lpBuffer=0x5bbebc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE", lpFilePart=0x0) returned 0x37 [0083.410] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE\\", nBufferLength=0x105, lpBuffer=0x5bbeb98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE\\", lpFilePart=0x0) returned 0x38 [0083.410] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE\\*", lpFindFileData=0x5bbede4 | out: lpFindFileData=0x5bbede4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb51728d0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xb51728d0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xb51728d0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0083.410] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb51728d0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xb51728d0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xb51728d0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.411] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbedf4 | out: lpFindFileData=0x5bbedf4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb51728d0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xb51728d0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xb51728d0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0083.411] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0083.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf07c) returned 1 [0083.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf088) returned 1 [0083.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf100) returned 1 [0083.411] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x5bbec08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x30 [0083.411] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x5bbebdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x31 [0083.411] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\*", lpFindFileData=0x5bbee28 | out: lpFindFileData=0x5bbee28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf67c2c30, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf67c2c30, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bd160 [0083.412] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf67c2c30, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf67c2c30, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.412] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x513882c0, ftCreationTime.dwHighDateTime=0x1d5e639, ftLastAccessTime.dwLowDateTime=0xa93da3d0, ftLastAccessTime.dwHighDateTime=0x1d5e25e, ftLastWriteTime.dwLowDateTime=0xa93da3d0, ftLastWriteTime.dwHighDateTime=0x1d5e25e, nFileSizeHigh=0x0, nFileSizeLow=0x33f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="2Z8kQwlSPW.avi", cAlternateFileName="2Z8KQW~1.AVI")) returned 1 [0083.412] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8aa26310, ftCreationTime.dwHighDateTime=0x1d5e304, ftLastAccessTime.dwLowDateTime=0x68df32d0, ftLastAccessTime.dwHighDateTime=0x1d5e575, ftLastWriteTime.dwLowDateTime=0x68df32d0, ftLastWriteTime.dwHighDateTime=0x1d5e575, nFileSizeHigh=0x0, nFileSizeLow=0x1778a, dwReserved0=0x0, dwReserved1=0x0, cFileName="4 gCmsKJ4.odp", cAlternateFileName="4GCMSK~1.ODP")) returned 1 [0083.412] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x88265730, ftCreationTime.dwHighDateTime=0x1d5dc0c, ftLastAccessTime.dwLowDateTime=0xf362d1d0, ftLastAccessTime.dwHighDateTime=0x1d5d992, ftLastWriteTime.dwLowDateTime=0xf362d1d0, ftLastWriteTime.dwHighDateTime=0x1d5d992, nFileSizeHigh=0x0, nFileSizeLow=0x3902, dwReserved0=0x0, dwReserved1=0x0, cFileName="5-au8sTR_DKW.bmp", cAlternateFileName="5-AU8S~1.BMP")) returned 1 [0083.412] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84e753a0, ftCreationTime.dwHighDateTime=0x1d5e5e2, ftLastAccessTime.dwLowDateTime=0x45006620, ftLastAccessTime.dwHighDateTime=0x1d5da5f, ftLastWriteTime.dwLowDateTime=0x45006620, ftLastWriteTime.dwHighDateTime=0x1d5da5f, nFileSizeHigh=0x0, nFileSizeLow=0x350e, dwReserved0=0x0, dwReserved1=0x0, cFileName="57qTz_2cSF05D7BsCcc.pps", cAlternateFileName="57QTZ_~1.PPS")) returned 1 [0083.413] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe0cff6c0, ftCreationTime.dwHighDateTime=0x1d5e062, ftLastAccessTime.dwLowDateTime=0xb986d250, ftLastAccessTime.dwHighDateTime=0x1d5e6d9, ftLastWriteTime.dwLowDateTime=0xb986d250, ftLastWriteTime.dwHighDateTime=0x1d5e6d9, nFileSizeHigh=0x0, nFileSizeLow=0x5964, dwReserved0=0x0, dwReserved1=0x0, cFileName="6o74G.mp3", cAlternateFileName="")) returned 1 [0083.413] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe58ff980, ftCreationTime.dwHighDateTime=0x1d5dee6, ftLastAccessTime.dwLowDateTime=0x73d64b0, ftLastAccessTime.dwHighDateTime=0x1d5dfe0, ftLastWriteTime.dwLowDateTime=0x73d64b0, ftLastWriteTime.dwHighDateTime=0x1d5dfe0, nFileSizeHigh=0x0, nFileSizeLow=0x100fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="7OhdXa3ktL4-VE8Up.mkv", cAlternateFileName="7OHDXA~1.MKV")) returned 1 [0083.413] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf3e40c90, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf3e40c90, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9df274b54410817b3690312b4cb55431", cAlternateFileName="9DF274~1")) returned 1 [0083.413] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a0318e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x6a0318e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xb20126a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeARM.log", cAlternateFileName="")) returned 1 [0083.414] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6be9bb00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x6be9bb00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x6be9bb00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bst449D.tmp", cAlternateFileName="")) returned 1 [0083.414] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5ca50, ftCreationTime.dwHighDateTime=0x1d5d89c, ftLastAccessTime.dwLowDateTime=0x6b882ea0, ftLastAccessTime.dwHighDateTime=0x1d5e729, ftLastWriteTime.dwLowDateTime=0x6b882ea0, ftLastWriteTime.dwHighDateTime=0x1d5e729, nFileSizeHigh=0x0, nFileSizeLow=0x3641, dwReserved0=0x0, dwReserved1=0x0, cFileName="BXPtYk9CKQNZ.bmp", cAlternateFileName="BXPTYK~1.BMP")) returned 1 [0083.414] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0083.414] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7adf8600, ftCreationTime.dwHighDateTime=0x1d5e012, ftLastAccessTime.dwLowDateTime=0xda8116a0, ftLastAccessTime.dwHighDateTime=0x1d5e44f, ftLastWriteTime.dwLowDateTime=0xda8116a0, ftLastWriteTime.dwHighDateTime=0x1d5e44f, nFileSizeHigh=0x0, nFileSizeLow=0x17a7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="d_9fzjXN59RtsG6FF.wav", cAlternateFileName="D_9FZJ~1.WAV")) returned 1 [0083.414] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa53eae00, ftCreationTime.dwHighDateTime=0x1d5e786, ftLastAccessTime.dwLowDateTime=0xb4ad3980, ftLastAccessTime.dwHighDateTime=0x1d5e4e6, ftLastWriteTime.dwLowDateTime=0xb4ad3980, ftLastWriteTime.dwHighDateTime=0x1d5e4e6, nFileSizeHigh=0x0, nFileSizeLow=0x309d, dwReserved0=0x0, dwReserved1=0x0, cFileName="EJsyP17Z.csv", cAlternateFileName="")) returned 1 [0083.415] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb84a230, ftCreationTime.dwHighDateTime=0x1d5de96, ftLastAccessTime.dwLowDateTime=0x91f8d5a0, ftLastAccessTime.dwHighDateTime=0x1d5e49d, ftLastWriteTime.dwLowDateTime=0x91f8d5a0, ftLastWriteTime.dwHighDateTime=0x1d5e49d, nFileSizeHigh=0x0, nFileSizeLow=0x51a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="F1_TNQKi1ckgpfT.docx", cAlternateFileName="F1_TNQ~1.DOC")) returned 1 [0083.415] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33d9ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x33d9ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FXSAPIDebugLogFile.txt", cAlternateFileName="FXSAPI~1.TXT")) returned 1 [0083.415] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1804b30, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf1804b30, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf1804b30, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="gpustats.bx", cAlternateFileName="")) returned 1 [0083.415] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9a5f1ab0, ftCreationTime.dwHighDateTime=0x1d5dbe7, ftLastAccessTime.dwLowDateTime=0x4a85c690, ftLastAccessTime.dwHighDateTime=0x1d5e0f8, ftLastWriteTime.dwLowDateTime=0x4a85c690, ftLastWriteTime.dwHighDateTime=0x1d5e0f8, nFileSizeHigh=0x0, nFileSizeLow=0x273e, dwReserved0=0x0, dwReserved1=0x0, cFileName="hI7dcq.wav", cAlternateFileName="")) returned 1 [0083.415] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0083.415] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x17aa39b0, ftCreationTime.dwHighDateTime=0x1d5d7d7, ftLastAccessTime.dwLowDateTime=0xbc1dbdd0, ftLastAccessTime.dwHighDateTime=0x1d5dc39, ftLastWriteTime.dwLowDateTime=0xbc1dbdd0, ftLastWriteTime.dwHighDateTime=0x1d5dc39, nFileSizeHigh=0x0, nFileSizeLow=0xeaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="jjjiPdyoEp5H.jpg", cAlternateFileName="JJJIPD~1.JPG")) returned 1 [0083.416] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1158a930, ftCreationTime.dwHighDateTime=0x1d5e7f3, ftLastAccessTime.dwLowDateTime=0xebb4dc10, ftLastAccessTime.dwHighDateTime=0x1d5e4c0, ftLastWriteTime.dwLowDateTime=0xebb4dc10, ftLastWriteTime.dwHighDateTime=0x1d5e4c0, nFileSizeHigh=0x0, nFileSizeLow=0x1e98, dwReserved0=0x0, dwReserved1=0x0, cFileName="KnapLok_XqWA.mp3", cAlternateFileName="KNAPLO~1.MP3")) returned 1 [0083.416] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x950b5510, ftCreationTime.dwHighDateTime=0x1d5e295, ftLastAccessTime.dwLowDateTime=0xa3334ea0, ftLastAccessTime.dwHighDateTime=0x1d5d8d5, ftLastWriteTime.dwLowDateTime=0xa3334ea0, ftLastWriteTime.dwHighDateTime=0x1d5d8d5, nFileSizeHigh=0x0, nFileSizeLow=0xad0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="LcuZSRQ81m.bmp", cAlternateFileName="LCUZSR~1.BMP")) returned 1 [0083.416] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c67fd30, ftCreationTime.dwHighDateTime=0x1d5dd11, ftLastAccessTime.dwLowDateTime=0x903b17a0, ftLastAccessTime.dwHighDateTime=0x1d5d93a, ftLastWriteTime.dwLowDateTime=0x903b17a0, ftLastWriteTime.dwHighDateTime=0x1d5d93a, nFileSizeHigh=0x0, nFileSizeLow=0x1258, dwReserved0=0x0, dwReserved1=0x0, cFileName="LGBlh.png", cAlternateFileName="")) returned 1 [0083.416] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef4c66b0, ftCreationTime.dwHighDateTime=0x1d5da78, ftLastAccessTime.dwLowDateTime=0x85fc9b20, ftLastAccessTime.dwHighDateTime=0x1d5d7b3, ftLastWriteTime.dwLowDateTime=0x85fc9b20, ftLastWriteTime.dwHighDateTime=0x1d5d7b3, nFileSizeHigh=0x0, nFileSizeLow=0x9a51, dwReserved0=0x0, dwReserved1=0x0, cFileName="lPhqwdd.mkv", cAlternateFileName="")) returned 1 [0083.416] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x67ed1350, ftCreationTime.dwHighDateTime=0x1d5dcb1, ftLastAccessTime.dwLowDateTime=0x5b143350, ftLastAccessTime.dwHighDateTime=0x1d5e000, ftLastWriteTime.dwLowDateTime=0x5b143350, ftLastWriteTime.dwHighDateTime=0x1d5e000, nFileSizeHigh=0x0, nFileSizeLow=0x274d, dwReserved0=0x0, dwReserved1=0x0, cFileName="lUUqXpadmhf.gif", cAlternateFileName="LUUQXP~1.GIF")) returned 1 [0083.417] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda42f130, ftCreationTime.dwHighDateTime=0x1d5d893, ftLastAccessTime.dwLowDateTime=0x95a0280, ftLastAccessTime.dwHighDateTime=0x1d5e2a6, ftLastWriteTime.dwLowDateTime=0x95a0280, ftLastWriteTime.dwHighDateTime=0x1d5e2a6, nFileSizeHigh=0x0, nFileSizeLow=0x17a2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="mVNMnSYtuQS.avi", cAlternateFileName="MVNMNS~1.AVI")) returned 1 [0083.417] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1a20dc80, ftCreationTime.dwHighDateTime=0x1d5e2ef, ftLastAccessTime.dwLowDateTime=0x4320ae30, ftLastAccessTime.dwHighDateTime=0x1d5daa2, ftLastWriteTime.dwLowDateTime=0x4320ae30, ftLastWriteTime.dwHighDateTime=0x1d5daa2, nFileSizeHigh=0x0, nFileSizeLow=0x8b09, dwReserved0=0x0, dwReserved1=0x0, cFileName="n3GtYqkuzgbfFej.bmp", cAlternateFileName="N3GTYQ~1.BMP")) returned 1 [0083.417] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42d5aff0, ftCreationTime.dwHighDateTime=0x1d5e4bd, ftLastAccessTime.dwLowDateTime=0xa3223490, ftLastAccessTime.dwHighDateTime=0x1d5de9c, ftLastWriteTime.dwLowDateTime=0xa3223490, ftLastWriteTime.dwHighDateTime=0x1d5de9c, nFileSizeHigh=0x0, nFileSizeLow=0x17b1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NQd6iEWAJJNDx9.swf", cAlternateFileName="NQD6IE~1.SWF")) returned 1 [0083.417] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x118b2650, ftCreationTime.dwHighDateTime=0x1d5ddec, ftLastAccessTime.dwLowDateTime=0x8c619c60, ftLastAccessTime.dwHighDateTime=0x1d5df2c, ftLastWriteTime.dwLowDateTime=0x8c619c60, ftLastWriteTime.dwHighDateTime=0x1d5df2c, nFileSizeHigh=0x0, nFileSizeLow=0x6d4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="pf8VR.doc", cAlternateFileName="")) returned 1 [0083.417] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xca0072f0, ftCreationTime.dwHighDateTime=0x1d5e43e, ftLastAccessTime.dwLowDateTime=0x488f7650, ftLastAccessTime.dwHighDateTime=0x1d5e702, ftLastWriteTime.dwLowDateTime=0x488f7650, ftLastWriteTime.dwHighDateTime=0x1d5e702, nFileSizeHigh=0x0, nFileSizeLow=0x1d2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="puMUyOkInN5vYu.bmp", cAlternateFileName="PUMUYO~1.BMP")) returned 1 [0083.417] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf67c2c30, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf67c2c30, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf67c2c30, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ran.bx", cAlternateFileName="")) returned 1 [0083.418] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfb72aa0, ftCreationTime.dwHighDateTime=0x1d5e7a5, ftLastAccessTime.dwLowDateTime=0x7ff5690, ftLastAccessTime.dwHighDateTime=0x1d5d808, ftLastWriteTime.dwLowDateTime=0x7ff5690, ftLastWriteTime.dwHighDateTime=0x1d5d808, nFileSizeHigh=0x0, nFileSizeLow=0x6e48, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGjKRO.bmp", cAlternateFileName="")) returned 1 [0083.418] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa89f0ac0, ftCreationTime.dwHighDateTime=0x1d5e6fc, ftLastAccessTime.dwLowDateTime=0xe0bf87e0, ftLastAccessTime.dwHighDateTime=0x1d5e3d7, ftLastWriteTime.dwLowDateTime=0xe0bf87e0, ftLastWriteTime.dwHighDateTime=0x1d5e3d7, nFileSizeHigh=0x0, nFileSizeLow=0x28a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="rukJ2ki9DOoDHhK.mp3", cAlternateFileName="RUKJ2K~1.MP3")) returned 1 [0083.418] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0083.418] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x31f5580, ftCreationTime.dwHighDateTime=0x1d5e294, ftLastAccessTime.dwLowDateTime=0xd0dd62b0, ftLastAccessTime.dwHighDateTime=0x1d5dd66, ftLastWriteTime.dwLowDateTime=0xd0dd62b0, ftLastWriteTime.dwHighDateTime=0x1d5dd66, nFileSizeHigh=0x0, nFileSizeLow=0x14645, dwReserved0=0x0, dwReserved1=0x0, cFileName="TgReyANn2kjAJUG9.png", cAlternateFileName="TGREYA~1.PNG")) returned 1 [0083.419] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x65818490, ftCreationTime.dwHighDateTime=0x1d5e493, ftLastAccessTime.dwLowDateTime=0x6af43ce0, ftLastAccessTime.dwHighDateTime=0x1d5de32, ftLastWriteTime.dwLowDateTime=0x6af43ce0, ftLastWriteTime.dwHighDateTime=0x1d5de32, nFileSizeHigh=0x0, nFileSizeLow=0xc74a, dwReserved0=0x0, dwReserved1=0x0, cFileName="tkAF 9Ybmddq50wDQaF.wav", cAlternateFileName="TKAF9Y~1.WAV")) returned 1 [0083.419] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb9717ff0, ftCreationTime.dwHighDateTime=0x1d5dcf1, ftLastAccessTime.dwLowDateTime=0xda373160, ftLastAccessTime.dwHighDateTime=0x1d5dfe6, ftLastWriteTime.dwLowDateTime=0xda373160, ftLastWriteTime.dwHighDateTime=0x1d5dfe6, nFileSizeHigh=0x0, nFileSizeLow=0x7527, dwReserved0=0x0, dwReserved1=0x0, cFileName="tzH31l45.jpg", cAlternateFileName="")) returned 1 [0083.419] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x92470b00, ftCreationTime.dwHighDateTime=0x1d5da3c, ftLastAccessTime.dwLowDateTime=0x36dca210, ftLastAccessTime.dwHighDateTime=0x1d5e2fd, ftLastWriteTime.dwLowDateTime=0x36dca210, ftLastWriteTime.dwHighDateTime=0x1d5e2fd, nFileSizeHigh=0x0, nFileSizeLow=0xbb08, dwReserved0=0x0, dwReserved1=0x0, cFileName="US-VXYmW_QdpRyP4RM1Z.xls", cAlternateFileName="US-VXY~1.XLS")) returned 1 [0083.419] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x89aadc0, ftCreationTime.dwHighDateTime=0x1d5d86c, ftLastAccessTime.dwLowDateTime=0xa9de8de0, ftLastAccessTime.dwHighDateTime=0x1d5e402, ftLastWriteTime.dwLowDateTime=0xa9de8de0, ftLastWriteTime.dwHighDateTime=0x1d5e402, nFileSizeHigh=0x0, nFileSizeLow=0x3c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="vor0Oy7pcXjnQD6PP.swf", cAlternateFileName="VOR0OY~1.SWF")) returned 1 [0083.419] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb51728d0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xb51728d0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xb51728d0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPDNSE", cAlternateFileName="")) returned 1 [0083.420] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2baaf60, ftCreationTime.dwHighDateTime=0x1d5ddf6, ftLastAccessTime.dwLowDateTime=0x75b2e5d0, ftLastAccessTime.dwHighDateTime=0x1d5de0c, ftLastWriteTime.dwLowDateTime=0x75b2e5d0, ftLastWriteTime.dwHighDateTime=0x1d5de0c, nFileSizeHigh=0x0, nFileSizeLow=0x7305, dwReserved0=0x0, dwReserved1=0x0, cFileName="wZuI0X8AKAWESBdA.avi", cAlternateFileName="WZUI0X~1.AVI")) returned 1 [0083.420] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcbf8a4a0, ftCreationTime.dwHighDateTime=0x1d5dc97, ftLastAccessTime.dwLowDateTime=0x407045a0, ftLastAccessTime.dwHighDateTime=0x1d5e331, ftLastWriteTime.dwLowDateTime=0x407045a0, ftLastWriteTime.dwHighDateTime=0x1d5e331, nFileSizeHigh=0x0, nFileSizeLow=0x18006, dwReserved0=0x0, dwReserved1=0x0, cFileName="YsijQxuL.wav", cAlternateFileName="")) returned 1 [0083.420] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3c8b92d0, ftCreationTime.dwHighDateTime=0x1d5e51d, ftLastAccessTime.dwLowDateTime=0x3f3caac0, ftLastAccessTime.dwHighDateTime=0x1d5dca6, ftLastWriteTime.dwLowDateTime=0x3f3caac0, ftLastWriteTime.dwHighDateTime=0x1d5dca6, nFileSizeHigh=0x0, nFileSizeLow=0xfd1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="zQJQyNI.pps", cAlternateFileName="")) returned 1 [0083.420] FindNextFileW (in: hFindFile=0x7bd160, lpFindFileData=0x5bbee38 | out: lpFindFileData=0x5bbee38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0083.420] FindClose (in: hFindFile=0x7bd160 | out: hFindFile=0x7bd160) returned 1 [0083.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf0c0) returned 1 [0083.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf0cc) returned 1 [0083.421] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x5bbec58, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0083.422] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x5bbec6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x30 [0083.422] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x5bbeb0c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0083.422] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Temp.txt", nBufferLength=0x105, lpBuffer=0x5bbeb20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Temp.txt", lpFilePart=0x0) returned 0x80 [0083.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf014) returned 1 [0083.422] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Temp.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs\\temp.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x380 [0083.424] GetFileType (hFile=0x380) returned 0x1 [0083.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf010) returned 1 [0083.424] GetFileType (hFile=0x380) returned 0x1 [0083.424] WriteFile (in: hFile=0x380, lpBuffer=0x27a39e4*, nNumberOfBytesToWrite=0x48d, lpNumberOfBytesWritten=0x5bbf0ac, lpOverlapped=0x0 | out: lpBuffer=0x27a39e4*, lpNumberOfBytesWritten=0x5bbf0ac*=0x48d, lpOverlapped=0x0) returned 1 [0083.426] CloseHandle (hObject=0x380) returned 1 [0083.672] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\discord\\Local Storage\\leveldb\\", nBufferLength=0x105, lpBuffer=0x5bbecb4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\discord\\Local Storage\\leveldb\\", lpFilePart=0x0) returned 0x4c [0083.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf110) returned 1 [0083.672] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\discord\\Local Storage\\leveldb\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\discord\\local storage\\leveldb"), fInfoLevelId=0x0, lpFileInformation=0x5bbf18c | out: lpFileInformation=0x5bbf18c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0083.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf10c) returned 1 [0084.270] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x5bbea6c | out: lpLuid=0x5bbea6c*(LowPart=0x14, HighPart=0)) returned 1 [0084.272] GetCurrentProcess () returned 0xffffffff [0084.273] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x5bbea68 | out: TokenHandle=0x5bbea68*=0x48c) returned 1 [0084.273] AdjustTokenPrivileges (in: TokenHandle=0x48c, DisableAllPrivileges=0, NewState=0x27a5c4c*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0084.273] CloseHandle (hObject=0x48c) returned 1 [0088.824] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x36898d0, Length=0x20000, ResultLength=0x5bbf148 | out: SystemInformation=0x36898d0, ResultLength=0x5bbf148*=0xe288) returned 0x0 [0088.947] CoTaskMemAlloc (cb=0x20c) returned 0x7e8c48 [0088.948] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x7e8c48 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x0 [0088.948] CoTaskMemFree (pv=0x7e8c48) [0088.948] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x5bbd4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpFilePart=0x0) returned 0x2d [0088.952] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\.purple\\accounts.xml", nBufferLength=0x105, lpBuffer=0x5bbecc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\.purple\\accounts.xml", lpFilePart=0x0) returned 0x42 [0088.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf124) returned 1 [0088.952] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\.purple\\accounts.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\.purple\\accounts.xml"), fInfoLevelId=0x0, lpFileInformation=0x5bbf1a0 | out: lpFileInformation=0x5bbf1a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0088.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf120) returned 1 [0088.966] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Psi+\\profiles\\default\\", nBufferLength=0x105, lpBuffer=0x5bbeca0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Psi+\\profiles\\default\\", lpFilePart=0x0) returned 0x44 [0088.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf168) returned 1 [0088.966] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Psi+\\profiles\\default\\", nBufferLength=0x105, lpBuffer=0x5bbec70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Psi+\\profiles\\default\\", lpFilePart=0x0) returned 0x44 [0088.966] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Psi+\\profiles\\default\\", nBufferLength=0x105, lpBuffer=0x5bbec44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Psi+\\profiles\\default\\", lpFilePart=0x0) returned 0x44 [0088.966] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Psi+\\profiles\\default\\*", lpFindFileData=0x5bbee90 | out: lpFindFileData=0x5bbee90*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0088.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf12c) returned 1 [0089.030] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Psi\\profiles\\default\\", nBufferLength=0x105, lpBuffer=0x5bbeca0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Psi\\profiles\\default\\", lpFilePart=0x0) returned 0x43 [0089.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf168) returned 1 [0089.031] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Psi\\profiles\\default\\", nBufferLength=0x105, lpBuffer=0x5bbec70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Psi\\profiles\\default\\", lpFilePart=0x0) returned 0x43 [0089.031] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Psi\\profiles\\default\\", nBufferLength=0x105, lpBuffer=0x5bbec44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Psi\\profiles\\default\\", lpFilePart=0x0) returned 0x43 [0089.031] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Psi\\profiles\\default\\*", lpFindFileData=0x5bbee90 | out: lpFindFileData=0x5bbee90*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0089.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf12c) returned 1 [0089.039] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Skype for Desktop", nBufferLength=0x105, lpBuffer=0x5bbecb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Skype for Desktop", lpFilePart=0x0) returned 0x49 [0089.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x5bbf10c) returned 1 [0089.039] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Skype for Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\skype for desktop"), fInfoLevelId=0x0, lpFileInformation=0x5bbf188 | out: lpFileInformation=0x5bbf188*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0089.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x5bbf108) returned 1 [0089.040] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0089.175] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0089.176] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0089.177] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0089.181] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0089.184] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0089.488] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0089.495] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0089.683] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0089.712] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0089.721] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0089.726] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0089.748] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0089.761] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0089.793] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0089.795] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0089.831] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0089.913] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0089.966] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.000] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.007] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.030] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.075] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.194] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.198] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.242] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.356] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.370] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.384] SleepEx (dwMilliseconds=0x0, bAlertable=0) Thread: id = 20 os_tid = 0x8ac Thread: id = 23 os_tid = 0x8fc Thread: id = 24 os_tid = 0x90c Thread: id = 25 os_tid = 0x91c Thread: id = 37 os_tid = 0xac8 Process: id = "3" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x714a7000" os_pid = "0x82c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x60c" cmd_line = "\"cmd.exe\" /C chcp 65001 && netsh wlan show profile | findstr All" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 16 os_tid = 0x83c [0075.911] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x3cf984 | out: lpSystemTimeAsFileTime=0x3cf984*(dwLowDateTime=0xf4c16c70, dwHighDateTime=0x1d69aea)) [0075.911] GetCurrentProcessId () returned 0x82c [0075.911] GetCurrentThreadId () returned 0x83c [0075.911] GetTickCount () returned 0x114c208 [0075.911] QueryPerformanceCounter (in: lpPerformanceCount=0x3cf97c | out: lpPerformanceCount=0x3cf97c*=19554210967) returned 1 [0075.913] GetModuleHandleA (lpModuleName=0x0) returned 0x4a240000 [0075.913] __set_app_type (_Type=0x1) [0075.913] __p__fmode () returned 0x770331f4 [0077.231] __p__commode () returned 0x770331fc [0077.232] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a2621a6) returned 0x0 [0077.232] __getmainargs (in: _Argc=0x4a264238, _Argv=0x4a264240, _Env=0x4a26423c, _DoWildCard=0, _StartInfo=0x4a264140 | out: _Argc=0x4a264238, _Argv=0x4a264240, _Env=0x4a26423c) returned 0 [0077.233] GetCurrentThreadId () returned 0x83c [0077.233] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x83c) returned 0x60 [0077.233] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0077.233] GetProcAddress (hModule=0x76d30000, lpProcName="SetThreadUILanguage") returned 0x76d5a84f [0077.233] SetThreadUILanguage (LangId=0x0) returned 0x409 [0077.235] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0077.235] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x3cf914 | out: phkResult=0x3cf914*=0x0) returned 0x2 [0077.236] VirtualQuery (in: lpAddress=0x3cf94b, lpBuffer=0x3cf8e4, dwLength=0x1c | out: lpBuffer=0x3cf8e4*(BaseAddress=0x3cf000, AllocationBase=0x2d0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0077.236] VirtualQuery (in: lpAddress=0x2d0000, lpBuffer=0x3cf8e4, dwLength=0x1c | out: lpBuffer=0x3cf8e4*(BaseAddress=0x2d0000, AllocationBase=0x2d0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0077.236] VirtualQuery (in: lpAddress=0x2d1000, lpBuffer=0x3cf8e4, dwLength=0x1c | out: lpBuffer=0x3cf8e4*(BaseAddress=0x2d1000, AllocationBase=0x2d0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0077.236] VirtualQuery (in: lpAddress=0x2d3000, lpBuffer=0x3cf8e4, dwLength=0x1c | out: lpBuffer=0x3cf8e4*(BaseAddress=0x2d3000, AllocationBase=0x2d0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0077.236] VirtualQuery (in: lpAddress=0x3d0000, lpBuffer=0x3cf8e4, dwLength=0x1c | out: lpBuffer=0x3cf8e4*(BaseAddress=0x3d0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x150000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0077.236] GetConsoleOutputCP () returned 0x1b5 [0077.236] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a264260 | out: lpCPInfo=0x4a264260) returned 1 [0077.236] SetConsoleCtrlHandler (HandlerRoutine=0x4a25e72a, Add=1) returned 1 [0077.236] _get_osfhandle (_FileHandle=1) returned 0x3c0 [0077.236] SetConsoleMode (hConsoleHandle=0x3c0, dwMode=0x0) returned 0 [0077.237] _get_osfhandle (_FileHandle=1) returned 0x3c0 [0077.237] GetConsoleMode (in: hConsoleHandle=0x3c0, lpMode=0x4a2641ac | out: lpMode=0x4a2641ac) returned 0 [0077.237] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0077.237] GetConsoleMode (in: hConsoleHandle=0xfffffffe, lpMode=0x4a2641b0 | out: lpMode=0x4a2641b0) returned 1 [0077.241] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0077.241] SetConsoleMode (hConsoleHandle=0xfffffffe, dwMode=0x7) returned 0 [0077.241] GetEnvironmentStringsW () returned 0x702050* [0077.242] GetProcessHeap () returned 0x6f0000 [0077.242] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0xaca) returned 0x702b28 [0077.242] FreeEnvironmentStringsW (penv=0x702050) returned 1 [0077.242] GetProcessHeap () returned 0x6f0000 [0077.242] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x4) returned 0x700c88 [0077.242] GetEnvironmentStringsW () returned 0x702050* [0077.242] GetProcessHeap () returned 0x6f0000 [0077.242] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0xaca) returned 0x703600 [0077.242] FreeEnvironmentStringsW (penv=0x702050) returned 1 [0077.242] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x3ce884 | out: phkResult=0x3ce884*=0x68) returned 0x0 [0077.243] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x3ce88c, lpData=0x3ce890, lpcbData=0x3ce888*=0x1000 | out: lpType=0x3ce88c*=0x0, lpData=0x3ce890*=0x0, lpcbData=0x3ce888*=0x1000) returned 0x2 [0077.243] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x3ce88c, lpData=0x3ce890, lpcbData=0x3ce888*=0x1000 | out: lpType=0x3ce88c*=0x4, lpData=0x3ce890*=0x1, lpcbData=0x3ce888*=0x4) returned 0x0 [0077.243] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x3ce88c, lpData=0x3ce890, lpcbData=0x3ce888*=0x1000 | out: lpType=0x3ce88c*=0x0, lpData=0x3ce890*=0x1, lpcbData=0x3ce888*=0x1000) returned 0x2 [0077.243] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x3ce88c, lpData=0x3ce890, lpcbData=0x3ce888*=0x1000 | out: lpType=0x3ce88c*=0x4, lpData=0x3ce890*=0x0, lpcbData=0x3ce888*=0x4) returned 0x0 [0077.243] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x3ce88c, lpData=0x3ce890, lpcbData=0x3ce888*=0x1000 | out: lpType=0x3ce88c*=0x4, lpData=0x3ce890*=0x40, lpcbData=0x3ce888*=0x4) returned 0x0 [0077.243] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x3ce88c, lpData=0x3ce890, lpcbData=0x3ce888*=0x1000 | out: lpType=0x3ce88c*=0x4, lpData=0x3ce890*=0x40, lpcbData=0x3ce888*=0x4) returned 0x0 [0077.243] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x3ce88c, lpData=0x3ce890, lpcbData=0x3ce888*=0x1000 | out: lpType=0x3ce88c*=0x0, lpData=0x3ce890*=0x40, lpcbData=0x3ce888*=0x1000) returned 0x2 [0077.243] RegCloseKey (hKey=0x68) returned 0x0 [0077.243] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x3ce884 | out: phkResult=0x3ce884*=0x68) returned 0x0 [0077.244] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x3ce88c, lpData=0x3ce890, lpcbData=0x3ce888*=0x1000 | out: lpType=0x3ce88c*=0x0, lpData=0x3ce890*=0x40, lpcbData=0x3ce888*=0x1000) returned 0x2 [0077.244] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x3ce88c, lpData=0x3ce890, lpcbData=0x3ce888*=0x1000 | out: lpType=0x3ce88c*=0x4, lpData=0x3ce890*=0x1, lpcbData=0x3ce888*=0x4) returned 0x0 [0077.244] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x3ce88c, lpData=0x3ce890, lpcbData=0x3ce888*=0x1000 | out: lpType=0x3ce88c*=0x0, lpData=0x3ce890*=0x1, lpcbData=0x3ce888*=0x1000) returned 0x2 [0077.244] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x3ce88c, lpData=0x3ce890, lpcbData=0x3ce888*=0x1000 | out: lpType=0x3ce88c*=0x4, lpData=0x3ce890*=0x0, lpcbData=0x3ce888*=0x4) returned 0x0 [0077.244] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x3ce88c, lpData=0x3ce890, lpcbData=0x3ce888*=0x1000 | out: lpType=0x3ce88c*=0x4, lpData=0x3ce890*=0x9, lpcbData=0x3ce888*=0x4) returned 0x0 [0077.244] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x3ce88c, lpData=0x3ce890, lpcbData=0x3ce888*=0x1000 | out: lpType=0x3ce88c*=0x4, lpData=0x3ce890*=0x9, lpcbData=0x3ce888*=0x4) returned 0x0 [0077.244] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x3ce88c, lpData=0x3ce890, lpcbData=0x3ce888*=0x1000 | out: lpType=0x3ce88c*=0x0, lpData=0x3ce890*=0x9, lpcbData=0x3ce888*=0x1000) returned 0x2 [0077.244] RegCloseKey (hKey=0x68) returned 0x0 [0077.244] time (in: timer=0x0 | out: timer=0x0) returned 0x5f7ace31 [0077.244] srand (_Seed=0x5f7ace31) [0077.244] GetCommandLineW () returned="\"cmd.exe\" /C chcp 65001 && netsh wlan show profile | findstr All" [0077.244] GetCommandLineW () returned="\"cmd.exe\" /C chcp 65001 && netsh wlan show profile | findstr All" [0077.726] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a265260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0077.726] GetProcessHeap () returned 0x6f0000 [0077.726] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x210) returned 0x702050 [0077.726] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x702058, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0078.557] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a270640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0078.558] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a270640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0078.558] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a270640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0078.558] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0078.558] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0078.558] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0078.558] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0078.558] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0078.558] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0078.558] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0078.558] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0078.558] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0078.558] GetProcessHeap () returned 0x6f0000 [0078.558] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x702b28 | out: hHeap=0x6f0000) returned 1 [0078.558] GetEnvironmentStringsW () returned 0x702268* [0078.558] GetProcessHeap () returned 0x6f0000 [0078.558] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0xae2) returned 0x704bc8 [0078.559] FreeEnvironmentStringsW (penv=0x702268) returned 1 [0078.559] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a270640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0078.559] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a270640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0078.559] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0078.559] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0078.559] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0078.559] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0078.559] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0078.559] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0078.559] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0078.559] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0078.559] GetProcessHeap () returned 0x6f0000 [0078.559] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x54) returned 0x7056b8 [0078.559] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x3cf650 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0078.559] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x3cf650, lpFilePart=0x3cf64c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x3cf64c*="Desktop") returned 0x25 [0078.560] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0078.560] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x3cf3cc | out: lpFindFileData=0x3cf3cc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x701ed0 [0078.561] FindClose (in: hFindFile=0x701ed0 | out: hFindFile=0x701ed0) returned 1 [0078.561] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x3cf3cc | out: lpFindFileData=0x3cf3cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x701ed0 [0078.606] FindClose (in: hFindFile=0x701ed0 | out: hFindFile=0x701ed0) returned 1 [0078.607] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0078.607] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x3cf3cc | out: lpFindFileData=0x3cf3cc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdc27b980, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xdc27b980, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x701ed0 [0078.607] FindClose (in: hFindFile=0x701ed0 | out: hFindFile=0x701ed0) returned 1 [0078.607] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0078.607] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0078.607] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0078.607] GetProcessHeap () returned 0x6f0000 [0078.608] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x704bc8 | out: hHeap=0x6f0000) returned 1 [0078.608] GetEnvironmentStringsW () returned 0x7040d8* [0078.608] GetProcessHeap () returned 0x6f0000 [0078.608] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0xb36) returned 0x705718 [0078.608] FreeEnvironmentStringsW (penv=0x7040d8) returned 1 [0078.608] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a265260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0078.608] GetProcessHeap () returned 0x6f0000 [0078.608] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x7056b8 | out: hHeap=0x6f0000) returned 1 [0078.608] GetProcessHeap () returned 0x6f0000 [0078.608] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x400e) returned 0x706258 [0078.613] GetProcessHeap () returned 0x6f0000 [0078.613] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x74) returned 0x70a288 [0078.613] GetProcessHeap () returned 0x6f0000 [0078.613] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x706258 | out: hHeap=0x6f0000) returned 1 [0078.614] GetConsoleOutputCP () returned 0x1b5 [0078.614] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a264260 | out: lpCPInfo=0x4a264260) returned 1 [0078.614] GetUserDefaultLCID () returned 0x409 [0078.616] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a264950, cchData=8 | out: lpLCData=":") returned 2 [0078.617] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x3cf790, cchData=128 | out: lpLCData="0") returned 2 [0078.617] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x3cf790, cchData=128 | out: lpLCData="0") returned 2 [0078.617] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x3cf790, cchData=128 | out: lpLCData="1") returned 2 [0078.617] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a264940, cchData=8 | out: lpLCData="/") returned 2 [0078.617] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a264d80, cchData=32 | out: lpLCData="Mon") returned 4 [0078.618] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a264d40, cchData=32 | out: lpLCData="Tue") returned 4 [0078.618] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a264d00, cchData=32 | out: lpLCData="Wed") returned 4 [0078.618] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a264cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0078.618] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a264c80, cchData=32 | out: lpLCData="Fri") returned 4 [0078.618] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a264c40, cchData=32 | out: lpLCData="Sat") returned 4 [0078.618] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a264c00, cchData=32 | out: lpLCData="Sun") returned 4 [0078.618] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a264930, cchData=8 | out: lpLCData=".") returned 2 [0078.618] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a264920, cchData=8 | out: lpLCData=",") returned 2 [0078.618] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0078.620] GetProcessHeap () returned 0x6f0000 [0078.620] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x20c) returned 0x702da8 [0078.620] GetConsoleTitleW (in: lpConsoleTitle=0x702da8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0078.621] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0078.621] GetProcAddress (hModule=0x76d30000, lpProcName="CopyFileExW") returned 0x76d63b92 [0078.621] GetProcAddress (hModule=0x76d30000, lpProcName="IsDebuggerPresent") returned 0x76d44a5d [0078.621] GetProcAddress (hModule=0x76d30000, lpProcName="SetConsoleInputExeNameW") returned 0x76d5a79d [0078.623] GetProcessHeap () returned 0x6f0000 [0078.623] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x400a) returned 0x706258 [0078.623] GetProcessHeap () returned 0x6f0000 [0078.623] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x706258 | out: hHeap=0x6f0000) returned 1 [0078.623] _wcsicmp (_String1="chcp", _String2=")") returned 58 [0078.623] _wcsicmp (_String1="FOR", _String2="chcp") returned 3 [0078.623] _wcsicmp (_String1="FOR/?", _String2="chcp") returned 3 [0078.623] _wcsicmp (_String1="IF", _String2="chcp") returned 6 [0078.624] _wcsicmp (_String1="IF/?", _String2="chcp") returned 6 [0078.624] _wcsicmp (_String1="REM", _String2="chcp") returned 15 [0078.624] _wcsicmp (_String1="REM/?", _String2="chcp") returned 15 [0078.624] GetProcessHeap () returned 0x6f0000 [0078.624] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x58) returned 0x702fc0 [0078.624] GetProcessHeap () returned 0x6f0000 [0078.624] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x12) returned 0x703020 [0078.624] GetProcessHeap () returned 0x6f0000 [0078.624] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x18) returned 0x703040 [0078.625] GetProcessHeap () returned 0x6f0000 [0078.625] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x58) returned 0x703060 [0078.626] _wcsicmp (_String1="FOR", _String2="netsh") returned -8 [0078.626] _wcsicmp (_String1="FOR/?", _String2="netsh") returned -8 [0078.626] _wcsicmp (_String1="IF", _String2="netsh") returned -5 [0078.626] _wcsicmp (_String1="IF/?", _String2="netsh") returned -5 [0078.626] _wcsicmp (_String1="REM", _String2="netsh") returned 4 [0078.626] _wcsicmp (_String1="REM/?", _String2="netsh") returned 4 [0078.626] GetProcessHeap () returned 0x6f0000 [0078.626] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x58) returned 0x7030c0 [0078.626] GetProcessHeap () returned 0x6f0000 [0078.626] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x14) returned 0x703120 [0078.627] GetProcessHeap () returned 0x6f0000 [0078.627] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x30) returned 0x703140 [0078.627] GetProcessHeap () returned 0x6f0000 [0078.627] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x58) returned 0x703178 [0078.628] _wcsicmp (_String1="FOR", _String2="findstr") returned 6 [0078.628] _wcsicmp (_String1="FOR/?", _String2="findstr") returned 6 [0078.628] _wcsicmp (_String1="IF", _String2="findstr") returned 3 [0078.628] _wcsicmp (_String1="IF/?", _String2="findstr") returned 3 [0078.628] _wcsicmp (_String1="REM", _String2="findstr") returned 12 [0078.628] _wcsicmp (_String1="REM/?", _String2="findstr") returned 12 [0078.628] GetProcessHeap () returned 0x6f0000 [0078.628] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x58) returned 0x7031d8 [0078.628] GetProcessHeap () returned 0x6f0000 [0078.628] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x18) returned 0x703238 [0078.628] GetProcessHeap () returned 0x6f0000 [0078.628] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x12) returned 0x703258 [0078.629] GetConsoleTitleW (in: lpConsoleTitle=0x3cf424, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0078.630] _wcsicmp (_String1="chcp", _String2="DIR") returned -1 [0078.630] _wcsicmp (_String1="chcp", _String2="ERASE") returned -2 [0078.630] _wcsicmp (_String1="chcp", _String2="DEL") returned -1 [0078.630] _wcsicmp (_String1="chcp", _String2="TYPE") returned -17 [0078.630] _wcsicmp (_String1="chcp", _String2="COPY") returned -7 [0078.630] _wcsicmp (_String1="chcp", _String2="CD") returned 4 [0078.630] _wcsicmp (_String1="chcp", _String2="CHDIR") returned -1 [0078.630] _wcsicmp (_String1="chcp", _String2="RENAME") returned -15 [0078.630] _wcsicmp (_String1="chcp", _String2="REN") returned -15 [0078.630] _wcsicmp (_String1="chcp", _String2="ECHO") returned -2 [0078.630] _wcsicmp (_String1="chcp", _String2="SET") returned -16 [0078.630] _wcsicmp (_String1="chcp", _String2="PAUSE") returned -13 [0078.630] _wcsicmp (_String1="chcp", _String2="DATE") returned -1 [0078.630] _wcsicmp (_String1="chcp", _String2="TIME") returned -17 [0078.630] _wcsicmp (_String1="chcp", _String2="PROMPT") returned -13 [0078.630] _wcsicmp (_String1="chcp", _String2="MD") returned -10 [0078.630] _wcsicmp (_String1="chcp", _String2="MKDIR") returned -10 [0078.630] _wcsicmp (_String1="chcp", _String2="RD") returned -15 [0078.630] _wcsicmp (_String1="chcp", _String2="RMDIR") returned -15 [0078.630] _wcsicmp (_String1="chcp", _String2="PATH") returned -13 [0078.630] _wcsicmp (_String1="chcp", _String2="GOTO") returned -4 [0078.630] _wcsicmp (_String1="chcp", _String2="SHIFT") returned -16 [0078.630] _wcsicmp (_String1="chcp", _String2="CLS") returned -4 [0078.630] _wcsicmp (_String1="chcp", _String2="CALL") returned 7 [0078.631] _wcsicmp (_String1="chcp", _String2="VERIFY") returned -19 [0078.631] _wcsicmp (_String1="chcp", _String2="VER") returned -19 [0078.631] _wcsicmp (_String1="chcp", _String2="VOL") returned -19 [0078.631] _wcsicmp (_String1="chcp", _String2="EXIT") returned -2 [0078.631] _wcsicmp (_String1="chcp", _String2="SETLOCAL") returned -16 [0078.631] _wcsicmp (_String1="chcp", _String2="ENDLOCAL") returned -2 [0078.631] _wcsicmp (_String1="chcp", _String2="TITLE") returned -17 [0078.631] _wcsicmp (_String1="chcp", _String2="START") returned -16 [0078.631] _wcsicmp (_String1="chcp", _String2="DPATH") returned -1 [0078.631] _wcsicmp (_String1="chcp", _String2="KEYS") returned -8 [0078.631] _wcsicmp (_String1="chcp", _String2="MOVE") returned -10 [0078.631] _wcsicmp (_String1="chcp", _String2="PUSHD") returned -13 [0078.631] _wcsicmp (_String1="chcp", _String2="POPD") returned -13 [0078.631] _wcsicmp (_String1="chcp", _String2="ASSOC") returned 2 [0078.631] _wcsicmp (_String1="chcp", _String2="FTYPE") returned -3 [0078.631] _wcsicmp (_String1="chcp", _String2="BREAK") returned 1 [0078.631] _wcsicmp (_String1="chcp", _String2="COLOR") returned -7 [0078.631] _wcsicmp (_String1="chcp", _String2="MKLINK") returned -10 [0078.631] _wcsicmp (_String1="chcp", _String2="DIR") returned -1 [0078.631] _wcsicmp (_String1="chcp", _String2="ERASE") returned -2 [0078.631] _wcsicmp (_String1="chcp", _String2="DEL") returned -1 [0078.631] _wcsicmp (_String1="chcp", _String2="TYPE") returned -17 [0078.631] _wcsicmp (_String1="chcp", _String2="COPY") returned -7 [0078.631] _wcsicmp (_String1="chcp", _String2="CD") returned 4 [0078.631] _wcsicmp (_String1="chcp", _String2="CHDIR") returned -1 [0078.631] _wcsicmp (_String1="chcp", _String2="RENAME") returned -15 [0078.631] _wcsicmp (_String1="chcp", _String2="REN") returned -15 [0078.631] _wcsicmp (_String1="chcp", _String2="ECHO") returned -2 [0078.632] _wcsicmp (_String1="chcp", _String2="SET") returned -16 [0078.632] _wcsicmp (_String1="chcp", _String2="PAUSE") returned -13 [0078.632] _wcsicmp (_String1="chcp", _String2="DATE") returned -1 [0078.632] _wcsicmp (_String1="chcp", _String2="TIME") returned -17 [0078.632] _wcsicmp (_String1="chcp", _String2="PROMPT") returned -13 [0078.632] _wcsicmp (_String1="chcp", _String2="MD") returned -10 [0078.632] _wcsicmp (_String1="chcp", _String2="MKDIR") returned -10 [0078.632] _wcsicmp (_String1="chcp", _String2="RD") returned -15 [0078.632] _wcsicmp (_String1="chcp", _String2="RMDIR") returned -15 [0078.632] _wcsicmp (_String1="chcp", _String2="PATH") returned -13 [0078.632] _wcsicmp (_String1="chcp", _String2="GOTO") returned -4 [0078.632] _wcsicmp (_String1="chcp", _String2="SHIFT") returned -16 [0078.632] _wcsicmp (_String1="chcp", _String2="CLS") returned -4 [0078.632] _wcsicmp (_String1="chcp", _String2="CALL") returned 7 [0078.632] _wcsicmp (_String1="chcp", _String2="VERIFY") returned -19 [0078.632] _wcsicmp (_String1="chcp", _String2="VER") returned -19 [0078.632] _wcsicmp (_String1="chcp", _String2="VOL") returned -19 [0078.632] _wcsicmp (_String1="chcp", _String2="EXIT") returned -2 [0078.632] _wcsicmp (_String1="chcp", _String2="SETLOCAL") returned -16 [0078.632] _wcsicmp (_String1="chcp", _String2="ENDLOCAL") returned -2 [0078.632] _wcsicmp (_String1="chcp", _String2="TITLE") returned -17 [0078.632] _wcsicmp (_String1="chcp", _String2="START") returned -16 [0078.632] _wcsicmp (_String1="chcp", _String2="DPATH") returned -1 [0078.632] _wcsicmp (_String1="chcp", _String2="KEYS") returned -8 [0078.632] _wcsicmp (_String1="chcp", _String2="MOVE") returned -10 [0078.632] _wcsicmp (_String1="chcp", _String2="PUSHD") returned -13 [0078.632] _wcsicmp (_String1="chcp", _String2="POPD") returned -13 [0078.633] _wcsicmp (_String1="chcp", _String2="ASSOC") returned 2 [0078.633] _wcsicmp (_String1="chcp", _String2="FTYPE") returned -3 [0078.633] _wcsicmp (_String1="chcp", _String2="BREAK") returned 1 [0078.633] _wcsicmp (_String1="chcp", _String2="COLOR") returned -7 [0078.633] _wcsicmp (_String1="chcp", _String2="MKLINK") returned -10 [0078.633] _wcsicmp (_String1="chcp", _String2="FOR") returned -3 [0078.633] _wcsicmp (_String1="chcp", _String2="IF") returned -6 [0078.633] _wcsicmp (_String1="chcp", _String2="REM") returned -15 [0078.633] GetProcessHeap () returned 0x6f0000 [0078.633] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x210) returned 0x703278 [0078.633] GetProcessHeap () returned 0x6f0000 [0078.633] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x22) returned 0x703490 [0078.633] _wcsnicmp (_String1="chcp", _String2="cmd ", _MaxCount=0x4) returned -5 [0078.633] GetProcessHeap () returned 0x6f0000 [0078.633] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x418) returned 0x6f07f0 [0078.633] SetErrorMode (uMode=0x0) returned 0x0 [0078.634] SetErrorMode (uMode=0x1) returned 0x0 [0078.634] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x6f07f8, lpFilePart=0x3cef44 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x3cef44*="Desktop") returned 0x25 [0078.634] SetErrorMode (uMode=0x0) returned 0x1 [0078.634] GetProcessHeap () returned 0x6f0000 [0078.634] RtlReAllocateHeap (Heap=0x6f0000, Flags=0x0, Ptr=0x6f07f0, Size=0x5e) returned 0x6f07f0 [0078.634] GetProcessHeap () returned 0x6f0000 [0078.634] RtlSizeHeap (HeapHandle=0x6f0000, Flags=0x0, MemoryPointer=0x6f07f0) returned 0x5e [0078.634] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a270640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0078.634] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0078.634] GetProcessHeap () returned 0x6f0000 [0078.634] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x120) returned 0x7034c0 [0078.634] GetProcessHeap () returned 0x6f0000 [0078.634] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x238) returned 0x6f0858 [0078.703] GetProcessHeap () returned 0x6f0000 [0078.703] RtlReAllocateHeap (Heap=0x6f0000, Flags=0x0, Ptr=0x6f0858, Size=0x122) returned 0x6f0858 [0078.703] GetProcessHeap () returned 0x6f0000 [0078.703] RtlSizeHeap (HeapHandle=0x6f0000, Flags=0x0, MemoryPointer=0x6f0858) returned 0x122 [0078.703] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a270640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0078.704] GetProcessHeap () returned 0x6f0000 [0078.704] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0xe0) returned 0x6f0988 [0078.704] GetProcessHeap () returned 0x6f0000 [0078.704] RtlReAllocateHeap (Heap=0x6f0000, Flags=0x0, Ptr=0x6f0988, Size=0x76) returned 0x6f0988 [0078.704] GetProcessHeap () returned 0x6f0000 [0078.704] RtlSizeHeap (HeapHandle=0x6f0000, Flags=0x0, MemoryPointer=0x6f0988) returned 0x76 [0079.218] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0079.218] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\chcp.*", fInfoLevelId=0x1, lpFindFileData=0x3cecc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cecc0) returned 0xffffffff [0079.218] GetLastError () returned 0x2 [0079.218] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\chcp", fInfoLevelId=0x1, lpFindFileData=0x3cecc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cecc0) returned 0xffffffff [0079.218] GetLastError () returned 0x2 [0079.218] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0079.219] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\chcp.*", fInfoLevelId=0x1, lpFindFileData=0x3cecc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cecc0) returned 0x6f0a08 [0079.219] GetProcessHeap () returned 0x6f0000 [0079.219] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x0, Size=0x14) returned 0x6f1248 [0079.219] FindClose (in: hFindFile=0x6f0a08 | out: hFindFile=0x6f0a08) returned 1 [0079.219] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\chcp.COM", fInfoLevelId=0x1, lpFindFileData=0x3cecc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cecc0) returned 0x6f0a08 [0079.219] GetProcessHeap () returned 0x6f0000 [0079.219] RtlReAllocateHeap (Heap=0x6f0000, Flags=0x0, Ptr=0x6f1248, Size=0x4) returned 0x6f1248 [0079.219] FindClose (in: hFindFile=0x6f0a08 | out: hFindFile=0x6f0a08) returned 1 [0079.219] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0079.219] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0079.219] GetConsoleTitleW (in: lpConsoleTitle=0x3cf1b8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0079.220] InitializeProcThreadAttributeList (in: lpAttributeList=0x3cf040, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x3cf108 | out: lpAttributeList=0x3cf040, lpSize=0x3cf108) returned 1 [0079.220] UpdateProcThreadAttribute (in: lpAttributeList=0x3cf040, dwFlags=0x0, Attribute=0x60001, lpValue=0x3cf100, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x3cf040, lpPreviousValue=0x0) returned 1 [0079.220] GetStartupInfoW (in: lpStartupInfo=0x3ceffc | out: lpStartupInfo=0x3ceffc*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x3c0, hStdError=0x3c8)) [0079.220] GetProcessHeap () returned 0x6f0000 [0079.220] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x18) returned 0x6f0a08 [0079.220] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0079.220] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0079.220] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0079.220] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0079.220] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0079.220] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0079.220] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0079.220] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0079.220] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0079.220] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0079.220] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0079.220] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0079.221] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0079.221] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0079.221] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0079.221] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0079.221] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0079.221] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0079.221] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0079.221] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0079.221] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0079.221] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0079.221] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0079.221] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0079.221] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0079.221] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0079.221] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0079.221] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0079.221] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0079.221] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0079.221] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0079.221] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0079.221] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0079.221] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0079.221] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0079.221] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0079.221] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0079.221] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0079.222] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0079.222] GetProcessHeap () returned 0x6f0000 [0079.222] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6f0a08 | out: hHeap=0x6f0000) returned 1 [0079.222] GetProcessHeap () returned 0x6f0000 [0079.222] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0xa) returned 0x6fff28 [0079.222] lstrcmpW (lpString1="\\chcp.com", lpString2="\\XCOPY.EXE") returned -1 [0079.224] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\chcp.com", lpCommandLine="chcp 65001 ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x3cf09c*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="chcp 65001 ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x3cf0e8 | out: lpCommandLine="chcp 65001 ", lpProcessInformation=0x3cf0e8*(hProcess=0x78, hThread=0x74, dwProcessId=0x8dc, dwThreadId=0x8ec)) returned 1 [0079.279] CloseHandle (hObject=0x74) returned 1 [0079.279] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0079.279] GetProcessHeap () returned 0x6f0000 [0079.279] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x705718 | out: hHeap=0x6f0000) returned 1 [0079.279] GetEnvironmentStringsW () returned 0x70c270* [0079.279] GetProcessHeap () returned 0x6f0000 [0079.279] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0xb36) returned 0x70cdb0 [0079.279] FreeEnvironmentStringsW (penv=0x70c270) returned 1 [0079.279] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0081.549] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x3cefdc | out: lpExitCode=0x3cefdc*=0x0) returned 1 [0081.549] CloseHandle (hObject=0x78) returned 1 [0081.549] _vsnwprintf (in: _Buffer=0x3cf124, _BufferCount=0x13, _Format="%08X", _ArgList=0x3cefe8 | out: _Buffer="00000000") returned 8 [0081.550] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0081.550] GetProcessHeap () returned 0x6f0000 [0081.550] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x70cdb0 | out: hHeap=0x6f0000) returned 1 [0081.550] GetEnvironmentStringsW () returned 0x70c270* [0081.550] GetProcessHeap () returned 0x6f0000 [0081.550] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0xb5c) returned 0x70cdd8 [0081.550] FreeEnvironmentStringsW (penv=0x70c270) returned 1 [0081.550] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0081.550] GetProcessHeap () returned 0x6f0000 [0081.550] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x70cdd8 | out: hHeap=0x6f0000) returned 1 [0081.550] GetEnvironmentStringsW () returned 0x70c270* [0081.550] GetProcessHeap () returned 0x6f0000 [0081.550] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0xb5c) returned 0x70cdd8 [0081.550] FreeEnvironmentStringsW (penv=0x70c270) returned 1 [0081.550] GetProcessHeap () returned 0x6f0000 [0081.550] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fff28 | out: hHeap=0x6f0000) returned 1 [0081.550] DeleteProcThreadAttributeList (in: lpAttributeList=0x3cf040 | out: lpAttributeList=0x3cf040) [0081.551] GetProcessHeap () returned 0x6f0000 [0081.551] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x30) returned 0x6ff400 [0081.551] _pipe (in: _PtHandles=0x6ff408, _PipeSize=0x0, _TextMode=32768 | out: _PtHandles=0x6ff408) returned 0 [0081.551] _dup (_FileHandle=1) returned 5 [0081.551] _dup2 (_FileHandleSrc=4, _FileHandleDst=1) returned 0 [0081.552] _close (_FileHandle=4) returned 0 [0081.552] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x4008) returned 0x704e80 [0081.552] _wcsicmp (_String1="netsh", _String2="DIR") returned 10 [0081.552] _wcsicmp (_String1="netsh", _String2="ERASE") returned 9 [0081.552] _wcsicmp (_String1="netsh", _String2="DEL") returned 10 [0081.552] _wcsicmp (_String1="netsh", _String2="TYPE") returned -6 [0081.552] _wcsicmp (_String1="netsh", _String2="COPY") returned 11 [0081.552] _wcsicmp (_String1="netsh", _String2="CD") returned 11 [0081.552] _wcsicmp (_String1="netsh", _String2="CHDIR") returned 11 [0081.552] _wcsicmp (_String1="netsh", _String2="RENAME") returned -4 [0081.552] _wcsicmp (_String1="netsh", _String2="REN") returned -4 [0081.552] _wcsicmp (_String1="netsh", _String2="ECHO") returned 9 [0081.552] _wcsicmp (_String1="netsh", _String2="SET") returned -5 [0081.552] _wcsicmp (_String1="netsh", _String2="PAUSE") returned -2 [0081.552] _wcsicmp (_String1="netsh", _String2="DATE") returned 10 [0081.552] _wcsicmp (_String1="netsh", _String2="TIME") returned -6 [0081.552] _wcsicmp (_String1="netsh", _String2="PROMPT") returned -2 [0081.552] _wcsicmp (_String1="netsh", _String2="MD") returned 1 [0081.552] _wcsicmp (_String1="netsh", _String2="MKDIR") returned 1 [0081.552] _wcsicmp (_String1="netsh", _String2="RD") returned -4 [0081.552] _wcsicmp (_String1="netsh", _String2="RMDIR") returned -4 [0081.553] _wcsicmp (_String1="netsh", _String2="PATH") returned -2 [0081.553] _wcsicmp (_String1="netsh", _String2="GOTO") returned 7 [0081.553] _wcsicmp (_String1="netsh", _String2="SHIFT") returned -5 [0081.553] _wcsicmp (_String1="netsh", _String2="CLS") returned 11 [0081.553] _wcsicmp (_String1="netsh", _String2="CALL") returned 11 [0081.553] _wcsicmp (_String1="netsh", _String2="VERIFY") returned -8 [0081.553] _wcsicmp (_String1="netsh", _String2="VER") returned -8 [0081.553] _wcsicmp (_String1="netsh", _String2="VOL") returned -8 [0081.553] _wcsicmp (_String1="netsh", _String2="EXIT") returned 9 [0081.553] _wcsicmp (_String1="netsh", _String2="SETLOCAL") returned -5 [0081.553] _wcsicmp (_String1="netsh", _String2="ENDLOCAL") returned 9 [0081.553] _wcsicmp (_String1="netsh", _String2="TITLE") returned -6 [0081.553] _wcsicmp (_String1="netsh", _String2="START") returned -5 [0081.553] _wcsicmp (_String1="netsh", _String2="DPATH") returned 10 [0081.553] _wcsicmp (_String1="netsh", _String2="KEYS") returned 3 [0081.553] _wcsicmp (_String1="netsh", _String2="MOVE") returned 1 [0081.553] _wcsicmp (_String1="netsh", _String2="PUSHD") returned -2 [0081.553] _wcsicmp (_String1="netsh", _String2="POPD") returned -2 [0081.553] _wcsicmp (_String1="netsh", _String2="ASSOC") returned 13 [0081.553] _wcsicmp (_String1="netsh", _String2="FTYPE") returned 8 [0081.553] _wcsicmp (_String1="netsh", _String2="BREAK") returned 12 [0081.553] _wcsicmp (_String1="netsh", _String2="COLOR") returned 11 [0081.553] _wcsicmp (_String1="netsh", _String2="MKLINK") returned 1 [0081.553] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x418) returned 0x70d940 [0081.554] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x70d948, lpFilePart=0x3cf590 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x3cf590*="Desktop") returned 0x25 [0081.554] SetErrorMode (uMode=0x0) returned 0x1 [0081.554] GetProcessHeap () returned 0x6f0000 [0081.554] RtlReAllocateHeap (Heap=0x6f0000, Flags=0x0, Ptr=0x70d940, Size=0x60) returned 0x70d940 [0081.554] GetProcessHeap () returned 0x6f0000 [0081.554] RtlSizeHeap (HeapHandle=0x6f0000, Flags=0x0, MemoryPointer=0x70d940) returned 0x60 [0081.554] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a270640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0081.554] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0081.554] GetProcessHeap () returned 0x6f0000 [0081.554] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x120) returned 0x70d9a8 [0081.554] GetProcessHeap () returned 0x6f0000 [0081.554] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x238) returned 0x70dad0 [0081.554] RtlReAllocateHeap (Heap=0x6f0000, Flags=0x0, Ptr=0x70dad0, Size=0x122) returned 0x70dad0 [0081.554] GetProcessHeap () returned 0x6f0000 [0081.554] RtlSizeHeap (HeapHandle=0x6f0000, Flags=0x0, MemoryPointer=0x70dad0) returned 0x122 [0081.554] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a270640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0081.554] GetProcessHeap () returned 0x6f0000 [0081.555] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0xe0) returned 0x70dc00 [0081.555] RtlReAllocateHeap (Heap=0x6f0000, Flags=0x0, Ptr=0x70dc00, Size=0x76) returned 0x70dc00 [0081.555] GetProcessHeap () returned 0x6f0000 [0081.555] RtlSizeHeap (HeapHandle=0x6f0000, Flags=0x0, MemoryPointer=0x70dc00) returned 0x76 [0081.555] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0081.555] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\netsh.*", fInfoLevelId=0x1, lpFindFileData=0x3cf30c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cf30c) returned 0xffffffff [0081.555] GetLastError () returned 0x2 [0081.555] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\netsh", fInfoLevelId=0x1, lpFindFileData=0x3cf30c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cf30c) returned 0xffffffff [0081.555] GetLastError () returned 0x2 [0081.555] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0081.556] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\netsh.*", fInfoLevelId=0x1, lpFindFileData=0x3cf30c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cf30c) returned 0x6f1258 [0081.675] FindClose (in: hFindFile=0x6f1258 | out: hFindFile=0x6f1258) returned 1 [0081.675] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\netsh.COM", fInfoLevelId=0x1, lpFindFileData=0x3cf30c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cf30c) returned 0xffffffff [0081.675] GetLastError () returned 0x2 [0081.675] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\netsh.EXE", fInfoLevelId=0x1, lpFindFileData=0x3cf30c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cf30c) returned 0x6f1258 [0081.676] FindClose (in: hFindFile=0x6f1258 | out: hFindFile=0x6f1258) returned 1 [0081.676] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0081.676] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0081.676] GetProcessHeap () returned 0x6f0000 [0081.676] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x18) returned 0x6f0a28 [0081.676] GetProcessHeap () returned 0x6f0000 [0081.676] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x210) returned 0x70dc80 [0081.676] GetProcessHeap () returned 0x6f0000 [0081.676] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x3c) returned 0x6f1258 [0081.676] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x418) returned 0x702268 [0081.676] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x702270, lpFilePart=0x3cf33c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x3cf33c*="Desktop") returned 0x25 [0081.676] SetErrorMode (uMode=0x0) returned 0x1 [0081.676] GetProcessHeap () returned 0x6f0000 [0081.676] RtlReAllocateHeap (Heap=0x6f0000, Flags=0x0, Ptr=0x702268, Size=0x60) returned 0x702268 [0081.676] GetProcessHeap () returned 0x6f0000 [0081.676] RtlSizeHeap (HeapHandle=0x6f0000, Flags=0x0, MemoryPointer=0x702268) returned 0x60 [0081.676] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a270640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0081.676] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0081.676] GetProcessHeap () returned 0x6f0000 [0081.676] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x120) returned 0x70de98 [0081.676] GetProcessHeap () returned 0x6f0000 [0081.676] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x238) returned 0x7022d0 [0081.676] RtlReAllocateHeap (Heap=0x6f0000, Flags=0x0, Ptr=0x7022d0, Size=0x122) returned 0x7022d0 [0081.676] GetProcessHeap () returned 0x6f0000 [0081.677] RtlSizeHeap (HeapHandle=0x6f0000, Flags=0x0, MemoryPointer=0x7022d0) returned 0x122 [0081.677] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a270640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0081.677] GetProcessHeap () returned 0x6f0000 [0081.677] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0xe0) returned 0x702400 [0081.677] RtlReAllocateHeap (Heap=0x6f0000, Flags=0x0, Ptr=0x702400, Size=0x76) returned 0x702400 [0081.677] GetProcessHeap () returned 0x6f0000 [0081.677] RtlSizeHeap (HeapHandle=0x6f0000, Flags=0x0, MemoryPointer=0x702400) returned 0x76 [0081.677] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0081.677] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\netsh.*", fInfoLevelId=0x1, lpFindFileData=0x3cf0b8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cf0b8) returned 0xffffffff [0081.677] GetLastError () returned 0x2 [0081.677] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\netsh", fInfoLevelId=0x1, lpFindFileData=0x3cf0b8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cf0b8) returned 0xffffffff [0081.677] GetLastError () returned 0x2 [0081.677] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0081.677] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\netsh.*", fInfoLevelId=0x1, lpFindFileData=0x3cf0b8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cf0b8) returned 0x7040d8 [0081.678] FindClose (in: hFindFile=0x7040d8 | out: hFindFile=0x7040d8) returned 1 [0081.678] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\netsh.COM", fInfoLevelId=0x1, lpFindFileData=0x3cf0b8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cf0b8) returned 0xffffffff [0081.678] GetLastError () returned 0x2 [0081.678] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\netsh.EXE", fInfoLevelId=0x1, lpFindFileData=0x3cf0b8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cf0b8) returned 0x7040d8 [0081.678] FindClose (in: hFindFile=0x7040d8 | out: hFindFile=0x7040d8) returned 1 [0081.678] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0081.678] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0081.678] GetConsoleTitleW (in: lpConsoleTitle=0x3cf5b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0081.678] InitializeProcThreadAttributeList (in: lpAttributeList=0x3cf438, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x3cf500 | out: lpAttributeList=0x3cf438, lpSize=0x3cf500) returned 1 [0081.678] UpdateProcThreadAttribute (in: lpAttributeList=0x3cf438, dwFlags=0x0, Attribute=0x60001, lpValue=0x3cf4f8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x3cf438, lpPreviousValue=0x0) returned 1 [0081.678] GetStartupInfoW (in: lpStartupInfo=0x3cf3f4 | out: lpStartupInfo=0x3cf3f4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x3c0, hStdError=0x3c8)) [0081.678] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x18) returned 0x70dfc0 [0081.679] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0081.679] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0081.679] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0081.679] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0081.679] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0081.679] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0081.679] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0081.679] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0081.679] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0081.679] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0081.679] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0081.679] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0081.679] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0081.679] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0081.679] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0081.679] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0081.679] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0081.679] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0081.679] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0081.679] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0081.679] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0081.679] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0081.679] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0081.679] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0081.679] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0081.679] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0081.679] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0081.679] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0081.679] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0081.679] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0081.679] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0081.679] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0081.680] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0081.680] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0081.680] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0081.680] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0081.680] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0081.680] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0081.680] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0081.680] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0081.680] GetProcessHeap () returned 0x6f0000 [0081.680] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x70dfc0 | out: hHeap=0x6f0000) returned 1 [0081.680] GetProcessHeap () returned 0x6f0000 [0081.680] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0xa) returned 0x6fff28 [0081.680] lstrcmpW (lpString1="\\netsh.exe", lpString2="\\XCOPY.EXE") returned -1 [0081.680] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\netsh.exe", lpCommandLine="netsh wlan show profile ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x3cf494*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="netsh wlan show profile ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x3cf4e0 | out: lpCommandLine="netsh wlan show profile ", lpProcessInformation=0x3cf4e0*(hProcess=0x84, hThread=0x80, dwProcessId=0x99c, dwThreadId=0x9ac)) returned 1 [0081.691] CloseHandle (hObject=0x80) returned 1 [0081.691] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0081.691] GetProcessHeap () returned 0x6f0000 [0081.691] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x70cdd8 | out: hHeap=0x6f0000) returned 1 [0081.691] GetEnvironmentStringsW () returned 0x708e90* [0081.691] GetProcessHeap () returned 0x6f0000 [0081.691] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0xb5c) returned 0x70c270 [0081.691] FreeEnvironmentStringsW (penv=0x708e90) returned 1 [0081.692] GetProcessHeap () returned 0x6f0000 [0081.692] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fff28 | out: hHeap=0x6f0000) returned 1 [0081.692] DeleteProcThreadAttributeList (in: lpAttributeList=0x3cf438 | out: lpAttributeList=0x3cf438) [0081.692] _get_osfhandle (_FileHandle=3) returned 0x74 [0081.692] DuplicateHandle (in: hSourceProcessHandle=0x84, hSourceHandle=0x74, hTargetProcessHandle=0x0, lpTargetHandle=0x0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x1 | out: lpTargetHandle=0x0) returned 1 [0081.692] _dup2 (_FileHandleSrc=5, _FileHandleDst=1) returned 0 [0081.692] _close (_FileHandle=5) returned 0 [0081.692] _dup (_FileHandle=0) returned 4 [0081.693] _dup2 (_FileHandleSrc=3, _FileHandleDst=0) returned 0 [0081.693] _close (_FileHandle=3) returned 0 [0081.693] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x4008) returned 0x70dfc0 [0081.694] _wcsicmp (_String1="findstr", _String2="DIR") returned 2 [0081.694] _wcsicmp (_String1="findstr", _String2="ERASE") returned 1 [0081.694] _wcsicmp (_String1="findstr", _String2="DEL") returned 2 [0081.694] _wcsicmp (_String1="findstr", _String2="TYPE") returned -14 [0081.694] _wcsicmp (_String1="findstr", _String2="COPY") returned 3 [0081.694] _wcsicmp (_String1="findstr", _String2="CD") returned 3 [0081.694] _wcsicmp (_String1="findstr", _String2="CHDIR") returned 3 [0081.694] _wcsicmp (_String1="findstr", _String2="RENAME") returned -12 [0081.694] _wcsicmp (_String1="findstr", _String2="REN") returned -12 [0081.694] _wcsicmp (_String1="findstr", _String2="ECHO") returned 1 [0081.694] _wcsicmp (_String1="findstr", _String2="SET") returned -13 [0081.694] _wcsicmp (_String1="findstr", _String2="PAUSE") returned -10 [0081.694] _wcsicmp (_String1="findstr", _String2="DATE") returned 2 [0081.694] _wcsicmp (_String1="findstr", _String2="TIME") returned -14 [0081.694] _wcsicmp (_String1="findstr", _String2="PROMPT") returned -10 [0081.694] _wcsicmp (_String1="findstr", _String2="MD") returned -7 [0081.694] _wcsicmp (_String1="findstr", _String2="MKDIR") returned -7 [0081.694] _wcsicmp (_String1="findstr", _String2="RD") returned -12 [0081.694] _wcsicmp (_String1="findstr", _String2="RMDIR") returned -12 [0081.694] _wcsicmp (_String1="findstr", _String2="PATH") returned -10 [0081.694] _wcsicmp (_String1="findstr", _String2="GOTO") returned -1 [0081.694] _wcsicmp (_String1="findstr", _String2="SHIFT") returned -13 [0081.694] _wcsicmp (_String1="findstr", _String2="CLS") returned 3 [0081.695] _wcsicmp (_String1="findstr", _String2="CALL") returned 3 [0081.695] _wcsicmp (_String1="findstr", _String2="VERIFY") returned -16 [0081.695] _wcsicmp (_String1="findstr", _String2="VER") returned -16 [0081.695] _wcsicmp (_String1="findstr", _String2="VOL") returned -16 [0081.695] _wcsicmp (_String1="findstr", _String2="EXIT") returned 1 [0081.695] _wcsicmp (_String1="findstr", _String2="SETLOCAL") returned -13 [0081.695] _wcsicmp (_String1="findstr", _String2="ENDLOCAL") returned 1 [0081.695] _wcsicmp (_String1="findstr", _String2="TITLE") returned -14 [0081.695] _wcsicmp (_String1="findstr", _String2="START") returned -13 [0081.695] _wcsicmp (_String1="findstr", _String2="DPATH") returned 2 [0081.695] _wcsicmp (_String1="findstr", _String2="KEYS") returned -5 [0081.695] _wcsicmp (_String1="findstr", _String2="MOVE") returned -7 [0081.695] _wcsicmp (_String1="findstr", _String2="PUSHD") returned -10 [0081.695] _wcsicmp (_String1="findstr", _String2="POPD") returned -10 [0081.695] _wcsicmp (_String1="findstr", _String2="ASSOC") returned 5 [0081.695] _wcsicmp (_String1="findstr", _String2="FTYPE") returned -11 [0081.695] _wcsicmp (_String1="findstr", _String2="BREAK") returned 4 [0081.695] _wcsicmp (_String1="findstr", _String2="COLOR") returned 3 [0081.695] _wcsicmp (_String1="findstr", _String2="MKLINK") returned -7 [0081.695] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x418) returned 0x702480 [0081.695] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x702488, lpFilePart=0x3cf590 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x3cf590*="Desktop") returned 0x25 [0081.695] SetErrorMode (uMode=0x0) returned 0x1 [0081.695] GetProcessHeap () returned 0x6f0000 [0081.695] RtlReAllocateHeap (Heap=0x6f0000, Flags=0x0, Ptr=0x702480, Size=0x64) returned 0x702480 [0081.695] GetProcessHeap () returned 0x6f0000 [0081.695] RtlSizeHeap (HeapHandle=0x6f0000, Flags=0x0, MemoryPointer=0x702480) returned 0x64 [0081.695] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a270640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0081.696] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0081.696] GetProcessHeap () returned 0x6f0000 [0081.696] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x120) returned 0x7024f0 [0081.696] GetProcessHeap () returned 0x6f0000 [0081.696] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x238) returned 0x702618 [0081.696] RtlReAllocateHeap (Heap=0x6f0000, Flags=0x0, Ptr=0x702618, Size=0x122) returned 0x702618 [0081.696] GetProcessHeap () returned 0x6f0000 [0081.696] RtlSizeHeap (HeapHandle=0x6f0000, Flags=0x0, MemoryPointer=0x702618) returned 0x122 [0081.696] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a270640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0081.696] GetProcessHeap () returned 0x6f0000 [0081.696] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0xe0) returned 0x702748 [0081.696] RtlReAllocateHeap (Heap=0x6f0000, Flags=0x0, Ptr=0x702748, Size=0x76) returned 0x702748 [0081.696] GetProcessHeap () returned 0x6f0000 [0081.696] RtlSizeHeap (HeapHandle=0x6f0000, Flags=0x0, MemoryPointer=0x702748) returned 0x76 [0081.696] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0081.696] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\findstr.*", fInfoLevelId=0x1, lpFindFileData=0x3cf30c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cf30c) returned 0xffffffff [0081.696] GetLastError () returned 0x2 [0081.696] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\findstr", fInfoLevelId=0x1, lpFindFileData=0x3cf30c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cf30c) returned 0xffffffff [0081.696] GetLastError () returned 0x2 [0081.697] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0081.697] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\findstr.*", fInfoLevelId=0x1, lpFindFileData=0x3cf30c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cf30c) returned 0x7040d8 [0081.697] FindClose (in: hFindFile=0x7040d8 | out: hFindFile=0x7040d8) returned 1 [0081.697] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\findstr.COM", fInfoLevelId=0x1, lpFindFileData=0x3cf30c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cf30c) returned 0xffffffff [0081.697] GetLastError () returned 0x2 [0081.697] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\findstr.EXE", fInfoLevelId=0x1, lpFindFileData=0x3cf30c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cf30c) returned 0x7040d8 [0081.697] FindClose (in: hFindFile=0x7040d8 | out: hFindFile=0x7040d8) returned 1 [0081.697] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0081.697] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0081.697] GetProcessHeap () returned 0x6f0000 [0081.697] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x18) returned 0x6f12a0 [0081.697] GetProcessHeap () returned 0x6f0000 [0081.697] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x210) returned 0x7027c8 [0081.697] GetProcessHeap () returned 0x6f0000 [0081.697] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x22) returned 0x7040d8 [0081.698] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x418) returned 0x70cdd8 [0081.698] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x70cde0, lpFilePart=0x3cf33c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x3cf33c*="Desktop") returned 0x25 [0081.698] SetErrorMode (uMode=0x0) returned 0x1 [0081.698] GetProcessHeap () returned 0x6f0000 [0081.698] RtlReAllocateHeap (Heap=0x6f0000, Flags=0x0, Ptr=0x70cdd8, Size=0x64) returned 0x70cdd8 [0081.698] GetProcessHeap () returned 0x6f0000 [0081.698] RtlSizeHeap (HeapHandle=0x6f0000, Flags=0x0, MemoryPointer=0x70cdd8) returned 0x64 [0081.698] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a270640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0081.698] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0081.698] GetProcessHeap () returned 0x6f0000 [0081.698] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x120) returned 0x7029e0 [0081.698] GetProcessHeap () returned 0x6f0000 [0081.698] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x238) returned 0x702b08 [0081.698] RtlReAllocateHeap (Heap=0x6f0000, Flags=0x0, Ptr=0x702b08, Size=0x122) returned 0x702b08 [0081.698] GetProcessHeap () returned 0x6f0000 [0081.698] RtlSizeHeap (HeapHandle=0x6f0000, Flags=0x0, MemoryPointer=0x702b08) returned 0x122 [0081.698] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a270640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0081.698] GetProcessHeap () returned 0x6f0000 [0081.698] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0xe0) returned 0x702c38 [0081.698] RtlReAllocateHeap (Heap=0x6f0000, Flags=0x0, Ptr=0x702c38, Size=0x76) returned 0x702c38 [0081.698] GetProcessHeap () returned 0x6f0000 [0081.698] RtlSizeHeap (HeapHandle=0x6f0000, Flags=0x0, MemoryPointer=0x702c38) returned 0x76 [0081.698] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0081.698] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\findstr.*", fInfoLevelId=0x1, lpFindFileData=0x3cf0b8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cf0b8) returned 0xffffffff [0081.699] GetLastError () returned 0x2 [0081.699] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\findstr", fInfoLevelId=0x1, lpFindFileData=0x3cf0b8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cf0b8) returned 0xffffffff [0081.699] GetLastError () returned 0x2 [0081.699] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0081.699] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\findstr.*", fInfoLevelId=0x1, lpFindFileData=0x3cf0b8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cf0b8) returned 0x704108 [0081.699] FindClose (in: hFindFile=0x704108 | out: hFindFile=0x704108) returned 1 [0081.699] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\findstr.COM", fInfoLevelId=0x1, lpFindFileData=0x3cf0b8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cf0b8) returned 0xffffffff [0081.699] GetLastError () returned 0x2 [0081.699] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\findstr.EXE", fInfoLevelId=0x1, lpFindFileData=0x3cf0b8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3cf0b8) returned 0x704108 [0081.699] FindClose (in: hFindFile=0x704108 | out: hFindFile=0x704108) returned 1 [0081.700] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0081.700] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0081.700] GetConsoleTitleW (in: lpConsoleTitle=0x3cf5b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0081.700] InitializeProcThreadAttributeList (in: lpAttributeList=0x3cf438, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x3cf500 | out: lpAttributeList=0x3cf438, lpSize=0x3cf500) returned 1 [0081.700] UpdateProcThreadAttribute (in: lpAttributeList=0x3cf438, dwFlags=0x0, Attribute=0x60001, lpValue=0x3cf4f8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x3cf438, lpPreviousValue=0x0) returned 1 [0081.700] GetStartupInfoW (in: lpStartupInfo=0x3cf3f4 | out: lpStartupInfo=0x3cf3f4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x80, hStdOutput=0x3c0, hStdError=0x3c8)) [0081.700] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0x18) returned 0x704108 [0081.700] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0081.700] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0081.700] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0081.700] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0081.700] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0081.700] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0081.700] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0081.700] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0081.700] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0081.700] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0081.700] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0081.700] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0081.700] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0081.700] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0081.700] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0081.700] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0081.701] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0081.701] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0081.701] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0081.701] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0081.701] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0081.701] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0081.701] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0081.701] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0081.701] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0081.701] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0081.701] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0081.701] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0081.701] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0081.701] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0081.701] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0081.701] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0081.701] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0081.701] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0081.701] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0081.701] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0081.701] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0081.701] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0081.701] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0081.701] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0081.701] GetProcessHeap () returned 0x6f0000 [0081.701] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x704108 | out: hHeap=0x6f0000) returned 1 [0081.701] GetProcessHeap () returned 0x6f0000 [0081.701] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0xa) returned 0x6fff28 [0081.701] lstrcmpW (lpString1="\\findstr.exe", lpString2="\\XCOPY.EXE") returned -1 [0081.701] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\findstr.exe", lpCommandLine="findstr All", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x3cf494*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="findstr All", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x3cf4e0 | out: lpCommandLine="findstr All", lpProcessInformation=0x3cf4e0*(hProcess=0x8c, hThread=0x74, dwProcessId=0xa58, dwThreadId=0x54c)) returned 1 [0082.461] CloseHandle (hObject=0x74) returned 1 [0082.461] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0082.461] GetProcessHeap () returned 0x6f0000 [0082.461] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x70c270 | out: hHeap=0x6f0000) returned 1 [0082.461] GetEnvironmentStringsW () returned 0x70c270* [0082.461] GetProcessHeap () returned 0x6f0000 [0082.461] RtlAllocateHeap (HeapHandle=0x6f0000, Flags=0x8, Size=0xb5c) returned 0x708e90 [0082.461] FreeEnvironmentStringsW (penv=0x70c270) returned 1 [0082.461] GetProcessHeap () returned 0x6f0000 [0082.461] HeapFree (in: hHeap=0x6f0000, dwFlags=0x0, lpMem=0x6fff28 | out: hHeap=0x6f0000) returned 1 [0082.461] DeleteProcThreadAttributeList (in: lpAttributeList=0x3cf438 | out: lpAttributeList=0x3cf438) [0082.461] _dup2 (_FileHandleSrc=4, _FileHandleDst=0) returned 0 [0082.461] _close (_FileHandle=4) returned 0 [0082.461] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0xffffffff) Process: id = "4" image_name = "ctfmom.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ctfmom.exe" page_root = "0x27810000" os_pid = "0x8bc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xb50" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 21 os_tid = 0x8cc [0080.152] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x22febc | out: lpSystemTimeAsFileTime=0x22febc*(dwLowDateTime=0xf57fda70, dwHighDateTime=0x1d69aea)) [0080.152] GetCurrentThreadId () returned 0x8cc [0080.152] GetCurrentProcessId () returned 0x8bc [0080.152] QueryPerformanceCounter (in: lpPerformanceCount=0x22feb4 | out: lpPerformanceCount=0x22feb4*=19979892690) returned 1 [0080.168] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0080.168] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0080.168] GetLastError () returned 0x57 [0080.168] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0080.169] GetLastError () returned 0x57 [0080.169] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76d30000 [0080.169] GetProcAddress (hModule=0x76d30000, lpProcName="InitializeCriticalSectionEx") returned 0x76d44d28 [0080.170] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0080.170] GetLastError () returned 0x57 [0080.170] GetProcAddress (hModule=0x76d30000, lpProcName="FlsAlloc") returned 0x76d44f2b [0080.170] GetProcAddress (hModule=0x76d30000, lpProcName="FlsSetValue") returned 0x76d44208 [0080.170] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0080.170] GetLastError () returned 0x57 [0080.170] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0080.170] GetLastError () returned 0x57 [0080.170] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76d30000 [0080.170] GetProcAddress (hModule=0x76d30000, lpProcName="InitializeCriticalSectionEx") returned 0x76d44d28 [0080.170] GetProcessHeap () returned 0x4d0000 [0080.170] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0080.170] GetLastError () returned 0x57 [0080.170] GetProcAddress (hModule=0x76d30000, lpProcName="FlsAlloc") returned 0x76d44f2b [0080.171] GetLastError () returned 0x57 [0080.171] GetProcAddress (hModule=0x76d30000, lpProcName="FlsGetValue") returned 0x76d41252 [0080.171] GetProcAddress (hModule=0x76d30000, lpProcName="FlsSetValue") returned 0x76d44208 [0080.171] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x364) returned 0x4e1e80 [0080.171] SetLastError (dwErrCode=0x57) [0080.171] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0xe00) returned 0x4e21f0 [0080.173] GetStartupInfoW (in: lpStartupInfo=0x22fdf4 | out: lpStartupInfo=0x22fdf4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x910860, hStdOutput=0x52fcced8, hStdError=0xfffffffe)) [0080.173] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0080.173] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0080.173] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0080.173] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe\" " [0080.173] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe\" " [0080.173] GetACP () returned 0x4e4 [0080.173] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x220) returned 0x4e37f8 [0080.173] IsValidCodePage (CodePage=0x4e4) returned 1 [0080.173] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x22fe14 | out: lpCPInfo=0x22fe14) returned 1 [0080.173] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x22f6dc | out: lpCPInfo=0x22f6dc) returned 1 [0080.173] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x22fcf0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0080.173] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x22fcf0, cbMultiByte=256, lpWideCharStr=0x22f478, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0080.173] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x22f6f0 | out: lpCharType=0x22f6f0) returned 1 [0080.173] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x22fcf0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0080.173] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x22fcf0, cbMultiByte=256, lpWideCharStr=0x22f438, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0080.173] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0080.173] GetLastError () returned 0x57 [0080.173] GetProcAddress (hModule=0x76d30000, lpProcName="LCMapStringEx") returned 0x76dc47f1 [0080.173] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0080.173] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x22f228, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0080.173] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x22fbf0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x0c´MR,þ\"", lpUsedDefaultChar=0x0) returned 256 [0080.173] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x22fcf0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0080.174] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x22fcf0, cbMultiByte=256, lpWideCharStr=0x22f448, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0080.174] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0080.174] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x22f238, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256 [0080.174] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x22faf0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x0c´MR,þ\"", lpUsedDefaultChar=0x0) returned 256 [0080.174] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x80) returned 0x4e0768 [0080.174] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x22fc38, nSize=0x105 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ctfmom.exe")) returned 0x42 [0080.174] GetProcAddress (hModule=0x76d30000, lpProcName="AreFileApisANSI") returned 0x76dc40d1 [0080.174] AreFileApisANSI () returned 1 [0080.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 67 [0080.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe", cchWideChar=-1, lpMultiByteStr=0x93b9b8, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe", lpUsedDefaultChar=0x0) returned 67 [0080.174] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x4b) returned 0x4e07f0 [0080.174] RtlInitializeSListHead (in: ListHead=0x93b780 | out: ListHead=0x93b780) [0080.174] GetLastError () returned 0x0 [0080.174] SetLastError (dwErrCode=0x0) [0080.174] GetEnvironmentStringsW () returned 0x4e3a20* [0080.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0080.174] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x565) returned 0x4e44f8 [0080.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x4e44f8, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0080.174] FreeEnvironmentStringsW (penv=0x4e3a20) returned 1 [0080.174] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x98) returned 0x4e0848 [0080.175] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x1f) returned 0x4e3380 [0080.175] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x36) returned 0x4e4a68 [0080.175] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x37) returned 0x4e4aa8 [0080.175] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3c) returned 0x4e4ae8 [0080.175] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x31) returned 0x4e4b30 [0080.175] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x17) returned 0x4e4b70 [0080.175] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x24) returned 0x4e4b90 [0080.175] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x14) returned 0x4e4bc0 [0080.175] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0xd) returned 0x4e0ad0 [0080.175] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x25) returned 0x4e4be0 [0080.175] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x39) returned 0x4e4c10 [0080.175] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x18) returned 0x4e4c58 [0080.175] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x17) returned 0x4e4c78 [0080.175] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0xe) returned 0x4e0ae8 [0080.175] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x69) returned 0x4e4c98 [0080.175] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x3e) returned 0x4e4d10 [0080.175] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x1b) returned 0x4e33a8 [0080.175] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x1d) returned 0x4e33d0 [0080.175] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x48) returned 0x4e4d58 [0080.175] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x12) returned 0x4e4da8 [0080.175] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x18) returned 0x4e4dc8 [0080.175] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x1b) returned 0x4e33f8 [0080.175] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x24) returned 0x4e4de8 [0080.175] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x29) returned 0x4e4e18 [0080.175] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x1e) returned 0x4e3420 [0080.175] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x41) returned 0x4e4e50 [0080.175] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x17) returned 0x4e4ea0 [0080.175] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0xf) returned 0x4e0b00 [0080.175] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x16) returned 0x4e4ec0 [0080.175] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x2a) returned 0x4e4ee0 [0080.175] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x29) returned 0x4e4f18 [0080.175] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x15) returned 0x4e4f50 [0080.175] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x1e) returned 0x4e3448 [0080.175] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x2a) returned 0x4e4f70 [0080.175] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x12) returned 0x4e4fa8 [0080.175] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x18) returned 0x4e4fc8 [0080.175] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x46) returned 0x4e3a20 [0080.175] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e44f8 | out: hHeap=0x4d0000) returned 1 [0080.176] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0080.176] GetProcAddress (hModule=0x76d30000, lpProcName="FlsAlloc") returned 0x76d44f2b [0080.176] GetProcAddress (hModule=0x76d30000, lpProcName="FlsFree") returned 0x76d4359f [0080.176] GetProcAddress (hModule=0x76d30000, lpProcName="FlsGetValue") returned 0x76d41252 [0080.176] GetProcAddress (hModule=0x76d30000, lpProcName="FlsSetValue") returned 0x76d44208 [0080.176] GetProcAddress (hModule=0x76d30000, lpProcName="InitializeCriticalSectionEx") returned 0x76d44d28 [0080.176] GetProcAddress (hModule=0x76d30000, lpProcName="InitOnceExecuteOnce") returned 0x76d5d627 [0080.176] GetProcAddress (hModule=0x76d30000, lpProcName="CreateEventExW") returned 0x76dc410b [0080.176] GetProcAddress (hModule=0x76d30000, lpProcName="CreateSemaphoreW") returned 0x76d5ca5a [0080.176] GetProcAddress (hModule=0x76d30000, lpProcName="CreateSemaphoreExW") returned 0x76dc4195 [0080.176] GetProcAddress (hModule=0x76d30000, lpProcName="CreateThreadpoolTimer") returned 0x76d5ee7e [0080.176] GetProcAddress (hModule=0x76d30000, lpProcName="SetThreadpoolTimer") returned 0x77c8441c [0080.176] GetProcAddress (hModule=0x76d30000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x77cac50e [0080.176] GetProcAddress (hModule=0x76d30000, lpProcName="CloseThreadpoolTimer") returned 0x77cac381 [0080.176] GetProcAddress (hModule=0x76d30000, lpProcName="CreateThreadpoolWait") returned 0x76d5f088 [0080.177] GetProcAddress (hModule=0x76d30000, lpProcName="SetThreadpoolWait") returned 0x77c905d7 [0080.177] GetProcAddress (hModule=0x76d30000, lpProcName="CloseThreadpoolWait") returned 0x77caca24 [0080.177] GetProcAddress (hModule=0x76d30000, lpProcName="FlushProcessWriteBuffers") returned 0x77c60b8c [0080.177] GetProcAddress (hModule=0x76d30000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x77d1fde8 [0080.177] GetProcAddress (hModule=0x76d30000, lpProcName="GetCurrentProcessorNumber") returned 0x77cb1e1d [0080.177] GetProcAddress (hModule=0x76d30000, lpProcName="CreateSymbolicLinkW") returned 0x76dbcd11 [0080.177] GetProcAddress (hModule=0x76d30000, lpProcName="GetCurrentPackageId") returned 0x0 [0080.177] GetProcAddress (hModule=0x76d30000, lpProcName="GetTickCount64") returned 0x76d5eee0 [0080.177] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileInformationByHandleEx") returned 0x76d5c78f [0080.177] GetProcAddress (hModule=0x76d30000, lpProcName="SetFileInformationByHandle") returned 0x76d6cbfc [0080.177] GetProcAddress (hModule=0x76d30000, lpProcName="GetSystemTimePreciseAsFileTime") returned 0x0 [0080.177] GetProcAddress (hModule=0x76d30000, lpProcName="InitializeConditionVariable") returned 0x77c78456 [0080.177] GetProcAddress (hModule=0x76d30000, lpProcName="WakeConditionVariable") returned 0x77ce7de4 [0080.177] GetProcAddress (hModule=0x76d30000, lpProcName="WakeAllConditionVariable") returned 0x77ca409d [0080.178] GetProcAddress (hModule=0x76d30000, lpProcName="SleepConditionVariableCS") returned 0x76dc4b32 [0080.178] GetProcAddress (hModule=0x76d30000, lpProcName="InitializeSRWLock") returned 0x77c78456 [0080.178] GetProcAddress (hModule=0x76d30000, lpProcName="AcquireSRWLockExclusive") returned 0x77c729f1 [0080.178] GetProcAddress (hModule=0x76d30000, lpProcName="TryAcquireSRWLockExclusive") returned 0x77c84892 [0080.178] GetProcAddress (hModule=0x76d30000, lpProcName="ReleaseSRWLockExclusive") returned 0x77c729ab [0080.178] GetProcAddress (hModule=0x76d30000, lpProcName="SleepConditionVariableSRW") returned 0x76dc4b74 [0080.178] GetProcAddress (hModule=0x76d30000, lpProcName="CreateThreadpoolWork") returned 0x76d5ee45 [0080.178] GetProcAddress (hModule=0x76d30000, lpProcName="SubmitThreadpoolWork") returned 0x77cb8491 [0080.178] GetProcAddress (hModule=0x76d30000, lpProcName="CloseThreadpoolWork") returned 0x77cad8e2 [0080.178] GetProcAddress (hModule=0x76d30000, lpProcName="CompareStringEx") returned 0x76dc46b1 [0080.178] GetProcAddress (hModule=0x76d30000, lpProcName="GetLocaleInfoEx") returned 0x76dc4751 [0080.178] GetProcAddress (hModule=0x76d30000, lpProcName="LCMapStringEx") returned 0x76dc47f1 [0080.178] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x800) returned 0x4e3a70 [0080.178] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0080.179] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x90e1c1) returned 0x0 [0080.179] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x8) returned 0x4dea60 [0080.179] LoadLibraryExW (lpLibFileName="api-ms-win-core-string-l1-1-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0080.179] GetLastError () returned 0x57 [0080.179] GetProcAddress (hModule=0x76d30000, lpProcName="CompareStringEx") returned 0x76dc46b1 [0080.179] GetProcAddress (hModule=0x76d30000, lpProcName="EnumSystemLocalesEx") returned 0x76dc424f [0080.179] LoadLibraryExW (lpLibFileName="api-ms-win-core-datetime-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0080.179] GetLastError () returned 0x57 [0080.179] GetProcAddress (hModule=0x76d30000, lpProcName="GetDateFormatEx") returned 0x76dd6676 [0080.180] GetProcAddress (hModule=0x76d30000, lpProcName="GetLocaleInfoEx") returned 0x76dc4751 [0080.180] GetProcAddress (hModule=0x76d30000, lpProcName="GetTimeFormatEx") returned 0x76dd65f1 [0080.180] GetProcAddress (hModule=0x76d30000, lpProcName="GetUserDefaultLocaleName") returned 0x76dc47c1 [0080.180] GetProcAddress (hModule=0x76d30000, lpProcName="IsValidLocaleName") returned 0x76dc47e1 [0080.180] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-obsolete-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0080.180] GetLastError () returned 0x57 [0080.180] GetProcAddress (hModule=0x76d30000, lpProcName="LCIDToLocaleName") returned 0x76d6ced4 [0080.180] GetProcAddress (hModule=0x76d30000, lpProcName="LocaleNameToLCID") returned 0x76dc4801 [0080.180] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x20) returned 0x4e3628 [0080.180] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x2) returned 0x4e08e8 [0080.180] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e08e8 | out: hHeap=0x4d0000) returned 1 [0080.180] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x2) returned 0x4e08e8 [0080.180] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x8) returned 0x4e46c0 [0080.180] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x18) returned 0x4e46d0 [0080.180] GetLastError () returned 0x57 [0080.180] SetLastError (dwErrCode=0x57) [0080.180] GetLastError () returned 0x57 [0080.180] SetLastError (dwErrCode=0x57) [0080.181] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0xb8) returned 0x4e46f0 [0080.181] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x6a6) returned 0x4e4fe8 [0080.181] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e4fe8 | out: hHeap=0x4d0000) returned 1 [0080.181] GetLastError () returned 0x57 [0080.181] SetLastError (dwErrCode=0x57) [0080.181] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x6) returned 0x4e47b0 [0080.181] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x2) returned 0x4e47c0 [0080.181] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x4) returned 0x4e47d0 [0080.181] GetLastError () returned 0x57 [0080.181] SetLastError (dwErrCode=0x57) [0080.181] GetLastError () returned 0x57 [0080.181] SetLastError (dwErrCode=0x57) [0080.181] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0xb8) returned 0x4e47e0 [0080.181] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x6a6) returned 0x4e4fe8 [0080.181] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e4fe8 | out: hHeap=0x4d0000) returned 1 [0080.181] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e47b0 | out: hHeap=0x4d0000) returned 1 [0080.181] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e46f0 | out: hHeap=0x4d0000) returned 1 [0080.181] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e47d0 | out: hHeap=0x4d0000) returned 1 [0080.181] GetLastError () returned 0x57 [0080.181] SetLastError (dwErrCode=0x57) [0080.181] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x6) returned 0x4e47d0 [0080.181] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x2) returned 0x4e46f0 [0080.182] GetLastError () returned 0x57 [0080.182] SetLastError (dwErrCode=0x57) [0080.182] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x200) returned 0x4e4fe8 [0080.182] GetLastError () returned 0x57 [0080.182] SetLastError (dwErrCode=0x57) [0080.182] GetLastError () returned 0x57 [0080.182] SetLastError (dwErrCode=0x57) [0080.182] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x4) returned 0x4e4700 [0080.182] GetLastError () returned 0x57 [0080.182] SetLastError (dwErrCode=0x57) [0080.182] GetLastError () returned 0x57 [0080.182] SetLastError (dwErrCode=0x57) [0080.182] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0xb8) returned 0x4e48a0 [0080.182] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x6a6) returned 0x4e51f0 [0080.182] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e51f0 | out: hHeap=0x4d0000) returned 1 [0080.182] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e47d0 | out: hHeap=0x4d0000) returned 1 [0080.182] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e47e0 | out: hHeap=0x4d0000) returned 1 [0080.182] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e4700 | out: hHeap=0x4d0000) returned 1 [0080.182] GetLastError () returned 0x57 [0080.182] SetLastError (dwErrCode=0x57) [0080.182] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x6) returned 0x4e4700 [0080.182] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e46f0 | out: hHeap=0x4d0000) returned 1 [0080.182] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e47c0 | out: hHeap=0x4d0000) returned 1 [0080.182] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x8) returned 0x4e46f0 [0080.182] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x8) returned 0x4e4960 [0080.183] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x8) returned 0x4e4970 [0080.183] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x50) returned 0x4e4980 [0080.183] GetStartupInfoW (in: lpStartupInfo=0x22fe58 | out: lpStartupInfo=0x22fe58*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0080.183] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x20) returned 0x4e3650 [0080.183] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e3650 | out: hHeap=0x4d0000) returned 1 [0080.183] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x8) returned 0x4e49d8 [0080.183] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x8) returned 0x4e49e8 [0080.183] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x38) returned 0x4e49f8 [0080.183] AreFileApisANSI () returned 1 [0080.183] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x4e4a70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 67 [0080.183] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x86) returned 0x4e4710 [0080.183] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x4e4a70, cbMultiByte=-1, lpWideCharStr=0x4e4710, cchWideChar=67 | out: lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe") returned 67 [0080.184] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ctfmom.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x22fa68, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54 [0080.196] GetFileType (hFile=0x54) returned 0x1 [0080.196] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e4710 | out: hHeap=0x4d0000) returned 1 [0080.196] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x8) returned 0x4e4a38 [0080.196] GetLastError () returned 0x0 [0080.196] SetLastError (dwErrCode=0x0) [0080.196] GetLastError () returned 0x0 [0080.196] SetLastError (dwErrCode=0x0) [0080.196] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0xb8) returned 0x4e4710 [0080.196] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x6a6) returned 0x4e51f0 [0080.196] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e51f0 | out: hHeap=0x4d0000) returned 1 [0080.196] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e4700 | out: hHeap=0x4d0000) returned 1 [0080.196] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e48a0 | out: hHeap=0x4d0000) returned 1 [0080.196] GetLastError () returned 0x0 [0080.196] SetLastError (dwErrCode=0x0) [0080.196] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x6) returned 0x4e4700 [0080.196] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x2) returned 0x4e4a48 [0080.196] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x4) returned 0x4e4a58 [0080.197] GetLastError () returned 0x0 [0080.197] SetLastError (dwErrCode=0x0) [0080.197] GetLastError () returned 0x0 [0080.197] SetLastError (dwErrCode=0x0) [0080.197] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0xb8) returned 0x4e47d0 [0080.197] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x6a6) returned 0x4e51f0 [0080.197] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e51f0 | out: hHeap=0x4d0000) returned 1 [0080.197] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e4700 | out: hHeap=0x4d0000) returned 1 [0080.197] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e4710 | out: hHeap=0x4d0000) returned 1 [0080.197] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e4a58 | out: hHeap=0x4d0000) returned 1 [0080.197] GetLastError () returned 0x0 [0080.197] SetLastError (dwErrCode=0x0) [0080.197] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x6) returned 0x4e4a58 [0080.197] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x2) returned 0x4e4700 [0080.197] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x4) returned 0x4e4710 [0080.197] GetLastError () returned 0x0 [0080.197] SetLastError (dwErrCode=0x0) [0080.197] GetLastError () returned 0x0 [0080.197] SetLastError (dwErrCode=0x0) [0080.197] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0xb8) returned 0x4e4890 [0080.197] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x6a6) returned 0x4e51f0 [0080.197] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e51f0 | out: hHeap=0x4d0000) returned 1 [0080.197] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e4a58 | out: hHeap=0x4d0000) returned 1 [0080.197] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e47d0 | out: hHeap=0x4d0000) returned 1 [0080.197] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e4710 | out: hHeap=0x4d0000) returned 1 [0080.197] GetLastError () returned 0x0 [0080.197] SetLastError (dwErrCode=0x0) [0080.198] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x6) returned 0x4e4a58 [0080.198] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e4700 | out: hHeap=0x4d0000) returned 1 [0080.198] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e4a48 | out: hHeap=0x4d0000) returned 1 [0080.198] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x8) returned 0x4e4a48 [0080.198] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", phkResult=0x22fa24 | out: phkResult=0x22fa24*=0x5c) returned 0x0 [0080.198] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x2, phkResult=0x22fa24 | out: phkResult=0x22fa24*=0x60) returned 0x0 [0080.198] RegCloseKey (hKey=0x60) returned 0x0 [0080.198] CloseHandle (hObject=0x54) returned 1 [0080.198] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e49e8 | out: hHeap=0x4d0000) returned 1 [0080.198] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e49d8 | out: hHeap=0x4d0000) returned 1 [0080.199] GetModuleHandleW (lpModuleName=0x0) returned 0x900000 [0080.199] GetModuleFileNameA (in: hModule=0x900000, lpFilename=0x22fb40, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ctfmom.exe")) returned 0x42 [0080.199] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x20) returned 0x4e3678 [0080.199] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e3678 | out: hHeap=0x4d0000) returned 1 [0080.199] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x20) returned 0x4e3678 [0080.199] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e3678 | out: hHeap=0x4d0000) returned 1 [0080.199] CopyFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ctfmom.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe\\Microsoft\\ctfmom.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ctfmom.exe\\microsoft\\ctfmom.exe"), bFailIfExists=1) returned 0 [0080.207] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x60) returned 0x4e4700 [0080.207] AreFileApisANSI () returned 1 [0080.207] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x4e4700, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 88 [0080.207] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0xb0) returned 0x4e4768 [0080.207] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x4e4700, cbMultiByte=-1, lpWideCharStr=0x4e4768, cchWideChar=88 | out: lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe\\Microsoft\\ctfmom.exe") returned 88 [0080.207] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe\\Microsoft\\ctfmom.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ctfmom.exe\\microsoft\\ctfmom.exe"), dwDesiredAccess=0x80, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff [0080.207] GetLastError () returned 0x3 [0080.207] SetLastError (dwErrCode=0x3) [0080.207] GetLastError () returned 0x3 [0080.207] SetLastError (dwErrCode=0x3) [0080.207] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe\\Microsoft\\ctfmom.exe", nBufferLength=0x104, lpBuffer=0x22f834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe\\Microsoft\\ctfmom.exe", lpFilePart=0x0) returned 0x57 [0080.208] GetLastError () returned 0x3 [0080.208] SetLastError (dwErrCode=0x3) [0080.208] GetLastError () returned 0x3 [0080.208] SetLastError (dwErrCode=0x3) [0080.208] GetLastError () returned 0x3 [0080.208] SetLastError (dwErrCode=0x3) [0080.208] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e4768 | out: hHeap=0x4d0000) returned 1 [0080.208] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e4700 | out: hHeap=0x4d0000) returned 1 [0080.208] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x20) returned 0x4e3678 [0080.208] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e3678 | out: hHeap=0x4d0000) returned 1 [0080.208] CopyFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ctfmom.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe\\Microsoft\\ctfmom.exe\\ctfmom.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ctfmom.exe\\microsoft\\ctfmom.exe\\ctfmom.exe"), bFailIfExists=1) returned 0 [0080.208] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x2, phkResult=0x22fb08 | out: phkResult=0x22fb08*=0x54) returned 0x0 [0080.209] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", phkResult=0x22fb0c | out: phkResult=0x22fb0c*=0x60) returned 0x0 [0080.209] RegSetValueExA (in: hKey=0x54, lpValueName="ctfmom", Reserved=0x0, dwType=0x1, lpData="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe\\Microsoft\\ctfmom.exe\" /noshow\\ctfmom.exe\" /noshow", cbData=0x104 | out: lpData="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe\\Microsoft\\ctfmom.exe\" /noshow\\ctfmom.exe\" /noshow") returned 0x0 [0080.210] RegSetValueExA (in: hKey=0x60, lpValueName="ctfmom", Reserved=0x0, dwType=0x1, lpData="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe\\Microsoft\\ctfmom.exe\" /noshow\\ctfmom.exe\" /noshow", cbData=0x104 | out: lpData="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe\\Microsoft\\ctfmom.exe\" /noshow\\ctfmom.exe\" /noshow") returned 0x0 [0080.211] RegCloseKey (hKey=0x54) returned 0x0 [0080.211] RegCloseKey (hKey=0x60) returned 0x0 [0080.310] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x8) returned 0x4e4950 [0080.310] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x8) returned 0x4e49d8 [0080.310] AreFileApisANSI () returned 1 [0080.310] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x936088, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0080.310] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x1e) returned 0x4e3678 [0080.310] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x936088, cbMultiByte=-1, lpWideCharStr=0x4e3678, cchWideChar=15 | out: lpWideCharStr="_CL_02f3a8c9sy") returned 15 [0080.310] CreateFileW (lpFileName="_CL_02f3a8c9sy" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_cl_02f3a8c9sy"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x22fb98, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0080.311] GetLastError () returned 0x2 [0080.311] GetLastError () returned 0x2 [0080.311] SetLastError (dwErrCode=0x2) [0080.311] GetLastError () returned 0x2 [0080.311] SetLastError (dwErrCode=0x2) [0080.311] GetLastError () returned 0x2 [0080.311] SetLastError (dwErrCode=0x2) [0080.311] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e3678 | out: hHeap=0x4d0000) returned 1 [0080.311] GetModuleHandleW (lpModuleName=0x0) returned 0x900000 [0080.311] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e4980 | out: hHeap=0x4d0000) returned 1 [0080.311] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e4a38 | out: hHeap=0x4d0000) returned 1 [0080.311] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e4a48 | out: hHeap=0x4d0000) returned 1 [0080.311] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e4fe8 | out: hHeap=0x4d0000) returned 1 [0080.311] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e46d0 | out: hHeap=0x4d0000) returned 1 [0080.311] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e46f0 | out: hHeap=0x4d0000) returned 1 [0080.311] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e4970 | out: hHeap=0x4d0000) returned 1 [0080.311] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e4960 | out: hHeap=0x4d0000) returned 1 [0080.311] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e46c0 | out: hHeap=0x4d0000) returned 1 [0080.311] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4dea60 | out: hHeap=0x4d0000) returned 1 [0080.312] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e0768 | out: hHeap=0x4d0000) returned 1 [0080.312] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e49f8 | out: hHeap=0x4d0000) returned 1 [0080.312] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e3a70 | out: hHeap=0x4d0000) returned 1 [0080.312] LoadLibraryExW (lpLibFileName="api-ms-win-appmodel-runtime-l1-1-2", hFile=0x0, dwFlags=0x800) returned 0x0 [0080.312] GetLastError () returned 0x57 [0080.312] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x22fd28 | out: phModule=0x22fd28) returned 0 [0080.312] ExitProcess (uExitCode=0x1) [0080.312] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e4a58 | out: hHeap=0x4d0000) returned 1 [0080.312] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e4890 | out: hHeap=0x4d0000) returned 1 [0080.312] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4e1e80 | out: hHeap=0x4d0000) returned 1 Process: id = "5" image_name = "chcp.com" filename = "c:\\windows\\syswow64\\chcp.com" page_root = "0x1fd7b000" os_pid = "0x8dc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x82c" cmd_line = "chcp 65001 " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 22 os_tid = 0x8ec Process: id = "6" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x71461000" os_pid = "0x92c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x60c" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /C tasklist /FO TABLE > \"C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\processes.txt\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 26 os_tid = 0x93c [0082.120] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x32fd4c | out: lpSystemTimeAsFileTime=0x32fd4c*(dwLowDateTime=0xf68f3730, dwHighDateTime=0x1d69aea)) [0082.120] GetCurrentProcessId () returned 0x92c [0082.120] GetCurrentThreadId () returned 0x93c [0082.120] GetTickCount () returned 0x114cdda [0082.120] QueryPerformanceCounter (in: lpPerformanceCount=0x32fd44 | out: lpPerformanceCount=0x32fd44*=20175142901) returned 1 [0082.122] GetModuleHandleA (lpModuleName=0x0) returned 0x4a240000 [0082.122] __set_app_type (_Type=0x1) [0082.122] __p__fmode () returned 0x770331f4 [0082.122] __p__commode () returned 0x770331fc [0082.122] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a2621a6) returned 0x0 [0082.122] __getmainargs (in: _Argc=0x4a264238, _Argv=0x4a264240, _Env=0x4a26423c, _DoWildCard=0, _StartInfo=0x4a264140 | out: _Argc=0x4a264238, _Argv=0x4a264240, _Env=0x4a26423c) returned 0 [0082.122] GetCurrentThreadId () returned 0x93c [0082.122] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x93c) returned 0x60 [0082.122] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0082.122] GetProcAddress (hModule=0x76d30000, lpProcName="SetThreadUILanguage") returned 0x76d5a84f [0082.122] SetThreadUILanguage (LangId=0x0) returned 0x409 [0082.244] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0082.244] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x32fcdc | out: phkResult=0x32fcdc*=0x0) returned 0x2 [0082.244] VirtualQuery (in: lpAddress=0x32fd13, lpBuffer=0x32fcac, dwLength=0x1c | out: lpBuffer=0x32fcac*(BaseAddress=0x32f000, AllocationBase=0x230000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0082.244] VirtualQuery (in: lpAddress=0x230000, lpBuffer=0x32fcac, dwLength=0x1c | out: lpBuffer=0x32fcac*(BaseAddress=0x230000, AllocationBase=0x230000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0082.244] VirtualQuery (in: lpAddress=0x231000, lpBuffer=0x32fcac, dwLength=0x1c | out: lpBuffer=0x32fcac*(BaseAddress=0x231000, AllocationBase=0x230000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0082.244] VirtualQuery (in: lpAddress=0x233000, lpBuffer=0x32fcac, dwLength=0x1c | out: lpBuffer=0x32fcac*(BaseAddress=0x233000, AllocationBase=0x230000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0082.244] VirtualQuery (in: lpAddress=0x330000, lpBuffer=0x32fcac, dwLength=0x1c | out: lpBuffer=0x32fcac*(BaseAddress=0x330000, AllocationBase=0x330000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0082.244] GetConsoleOutputCP () returned 0x1b5 [0082.244] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a264260 | out: lpCPInfo=0x4a264260) returned 1 [0082.244] SetConsoleCtrlHandler (HandlerRoutine=0x4a25e72a, Add=1) returned 1 [0082.244] _get_osfhandle (_FileHandle=1) returned 0x7 [0082.244] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0082.245] _get_osfhandle (_FileHandle=1) returned 0x7 [0082.245] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a2641ac | out: lpMode=0x4a2641ac) returned 1 [0082.245] _get_osfhandle (_FileHandle=1) returned 0x7 [0082.245] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0082.245] _get_osfhandle (_FileHandle=0) returned 0x3 [0082.245] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a2641b0 | out: lpMode=0x4a2641b0) returned 1 [0082.245] _get_osfhandle (_FileHandle=0) returned 0x3 [0082.245] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0082.246] GetEnvironmentStringsW () returned 0x7a2188* [0082.246] GetProcessHeap () returned 0x790000 [0082.246] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0xaca) returned 0x7a2c60 [0082.246] FreeEnvironmentStringsW (penv=0x7a2188) returned 1 [0082.246] GetProcessHeap () returned 0x790000 [0082.246] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0x4) returned 0x7a1868 [0082.246] GetEnvironmentStringsW () returned 0x7a2188* [0082.246] GetProcessHeap () returned 0x790000 [0082.246] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0xaca) returned 0x7a3738 [0082.246] FreeEnvironmentStringsW (penv=0x7a2188) returned 1 [0082.246] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x32ec4c | out: phkResult=0x32ec4c*=0x68) returned 0x0 [0082.247] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x32ec54, lpData=0x32ec58, lpcbData=0x32ec50*=0x1000 | out: lpType=0x32ec54*=0x0, lpData=0x32ec58*=0x0, lpcbData=0x32ec50*=0x1000) returned 0x2 [0082.247] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x32ec54, lpData=0x32ec58, lpcbData=0x32ec50*=0x1000 | out: lpType=0x32ec54*=0x4, lpData=0x32ec58*=0x1, lpcbData=0x32ec50*=0x4) returned 0x0 [0082.247] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x32ec54, lpData=0x32ec58, lpcbData=0x32ec50*=0x1000 | out: lpType=0x32ec54*=0x0, lpData=0x32ec58*=0x1, lpcbData=0x32ec50*=0x1000) returned 0x2 [0082.247] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x32ec54, lpData=0x32ec58, lpcbData=0x32ec50*=0x1000 | out: lpType=0x32ec54*=0x4, lpData=0x32ec58*=0x0, lpcbData=0x32ec50*=0x4) returned 0x0 [0082.247] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x32ec54, lpData=0x32ec58, lpcbData=0x32ec50*=0x1000 | out: lpType=0x32ec54*=0x4, lpData=0x32ec58*=0x40, lpcbData=0x32ec50*=0x4) returned 0x0 [0082.247] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x32ec54, lpData=0x32ec58, lpcbData=0x32ec50*=0x1000 | out: lpType=0x32ec54*=0x4, lpData=0x32ec58*=0x40, lpcbData=0x32ec50*=0x4) returned 0x0 [0082.247] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x32ec54, lpData=0x32ec58, lpcbData=0x32ec50*=0x1000 | out: lpType=0x32ec54*=0x0, lpData=0x32ec58*=0x40, lpcbData=0x32ec50*=0x1000) returned 0x2 [0082.247] RegCloseKey (hKey=0x68) returned 0x0 [0082.247] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x32ec4c | out: phkResult=0x32ec4c*=0x68) returned 0x0 [0082.247] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x32ec54, lpData=0x32ec58, lpcbData=0x32ec50*=0x1000 | out: lpType=0x32ec54*=0x0, lpData=0x32ec58*=0x40, lpcbData=0x32ec50*=0x1000) returned 0x2 [0082.247] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x32ec54, lpData=0x32ec58, lpcbData=0x32ec50*=0x1000 | out: lpType=0x32ec54*=0x4, lpData=0x32ec58*=0x1, lpcbData=0x32ec50*=0x4) returned 0x0 [0082.247] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x32ec54, lpData=0x32ec58, lpcbData=0x32ec50*=0x1000 | out: lpType=0x32ec54*=0x0, lpData=0x32ec58*=0x1, lpcbData=0x32ec50*=0x1000) returned 0x2 [0082.247] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x32ec54, lpData=0x32ec58, lpcbData=0x32ec50*=0x1000 | out: lpType=0x32ec54*=0x4, lpData=0x32ec58*=0x0, lpcbData=0x32ec50*=0x4) returned 0x0 [0082.247] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x32ec54, lpData=0x32ec58, lpcbData=0x32ec50*=0x1000 | out: lpType=0x32ec54*=0x4, lpData=0x32ec58*=0x9, lpcbData=0x32ec50*=0x4) returned 0x0 [0082.247] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x32ec54, lpData=0x32ec58, lpcbData=0x32ec50*=0x1000 | out: lpType=0x32ec54*=0x4, lpData=0x32ec58*=0x9, lpcbData=0x32ec50*=0x4) returned 0x0 [0082.248] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x32ec54, lpData=0x32ec58, lpcbData=0x32ec50*=0x1000 | out: lpType=0x32ec54*=0x0, lpData=0x32ec58*=0x9, lpcbData=0x32ec50*=0x1000) returned 0x2 [0082.248] RegCloseKey (hKey=0x68) returned 0x0 [0082.248] time (in: timer=0x0 | out: timer=0x0) returned 0x5f7ace34 [0082.248] srand (_Seed=0x5f7ace34) [0082.248] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /C tasklist /FO TABLE > \"C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\processes.txt\"" [0082.248] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /C tasklist /FO TABLE > \"C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\processes.txt\"" [0082.248] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a265260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0082.248] GetProcessHeap () returned 0x790000 [0082.248] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0x210) returned 0x7a2188 [0082.248] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7a2190, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0082.248] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a270640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0082.248] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a270640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0082.248] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a270640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0082.248] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0082.248] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0082.249] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0082.249] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0082.249] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0082.249] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0082.249] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0082.249] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0082.249] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0082.249] GetProcessHeap () returned 0x790000 [0082.249] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7a2c60 | out: hHeap=0x790000) returned 1 [0082.249] GetEnvironmentStringsW () returned 0x7a23a0* [0082.249] GetProcessHeap () returned 0x790000 [0082.249] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0xae2) returned 0x7a4d00 [0082.249] FreeEnvironmentStringsW (penv=0x7a23a0) returned 1 [0082.249] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a270640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0082.249] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a270640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0082.249] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0082.249] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0082.249] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0082.249] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0082.249] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0082.249] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0082.249] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0082.249] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0082.249] GetProcessHeap () returned 0x790000 [0082.249] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0x54) returned 0x7a57f0 [0082.249] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x32fa18 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0082.249] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x32fa18, lpFilePart=0x32fa14 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x32fa14*="Desktop") returned 0x25 [0082.250] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0082.250] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x32f794 | out: lpFindFileData=0x32f794*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x7a2008 [0082.250] FindClose (in: hFindFile=0x7a2008 | out: hFindFile=0x7a2008) returned 1 [0082.250] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x32f794 | out: lpFindFileData=0x32f794*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x7a2008 [0082.250] FindClose (in: hFindFile=0x7a2008 | out: hFindFile=0x7a2008) returned 1 [0082.250] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0082.250] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x32f794 | out: lpFindFileData=0x32f794*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf53d33f0, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf53d33f0, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x7a2008 [0082.250] FindClose (in: hFindFile=0x7a2008 | out: hFindFile=0x7a2008) returned 1 [0082.250] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0082.250] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0082.250] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0082.250] GetProcessHeap () returned 0x790000 [0082.251] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7a4d00 | out: hHeap=0x790000) returned 1 [0082.251] GetEnvironmentStringsW () returned 0x7a4210* [0082.251] GetProcessHeap () returned 0x790000 [0082.251] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0xb36) returned 0x7a5850 [0082.251] FreeEnvironmentStringsW (penv=0x7a4210) returned 1 [0082.251] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a265260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0082.251] GetProcessHeap () returned 0x790000 [0082.251] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7a57f0 | out: hHeap=0x790000) returned 1 [0082.251] GetProcessHeap () returned 0x790000 [0082.251] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0x400e) returned 0x7a6390 [0082.251] GetProcessHeap () returned 0x790000 [0082.251] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0x124) returned 0x790ff0 [0082.251] GetProcessHeap () returned 0x790000 [0082.252] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7a6390 | out: hHeap=0x790000) returned 1 [0082.252] GetConsoleOutputCP () returned 0x1b5 [0082.252] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a264260 | out: lpCPInfo=0x4a264260) returned 1 [0082.252] GetUserDefaultLCID () returned 0x409 [0082.252] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a264950, cchData=8 | out: lpLCData=":") returned 2 [0082.253] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x32fb58, cchData=128 | out: lpLCData="0") returned 2 [0082.253] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x32fb58, cchData=128 | out: lpLCData="0") returned 2 [0082.253] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x32fb58, cchData=128 | out: lpLCData="1") returned 2 [0082.253] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a264940, cchData=8 | out: lpLCData="/") returned 2 [0082.253] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a264d80, cchData=32 | out: lpLCData="Mon") returned 4 [0082.253] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a264d40, cchData=32 | out: lpLCData="Tue") returned 4 [0082.253] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a264d00, cchData=32 | out: lpLCData="Wed") returned 4 [0082.253] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a264cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0082.253] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a264c80, cchData=32 | out: lpLCData="Fri") returned 4 [0082.253] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a264c40, cchData=32 | out: lpLCData="Sat") returned 4 [0082.254] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a264c00, cchData=32 | out: lpLCData="Sun") returned 4 [0082.254] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a264930, cchData=8 | out: lpLCData=".") returned 2 [0082.254] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a264920, cchData=8 | out: lpLCData=",") returned 2 [0082.254] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0082.255] GetProcessHeap () returned 0x790000 [0082.255] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x20c) returned 0x7a2ee0 [0082.255] GetConsoleTitleW (in: lpConsoleTitle=0x7a2ee0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0082.255] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0082.255] GetProcAddress (hModule=0x76d30000, lpProcName="CopyFileExW") returned 0x76d63b92 [0082.256] GetProcAddress (hModule=0x76d30000, lpProcName="IsDebuggerPresent") returned 0x76d44a5d [0082.256] GetProcAddress (hModule=0x76d30000, lpProcName="SetConsoleInputExeNameW") returned 0x76d5a79d [0082.256] GetProcessHeap () returned 0x790000 [0082.256] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0x400a) returned 0x7a6390 [0082.256] GetProcessHeap () returned 0x790000 [0082.256] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7a6390 | out: hHeap=0x790000) returned 1 [0082.257] _wcsicmp (_String1="tasklist", _String2=")") returned 75 [0082.257] _wcsicmp (_String1="FOR", _String2="tasklist") returned -14 [0082.257] _wcsicmp (_String1="FOR/?", _String2="tasklist") returned -14 [0082.257] _wcsicmp (_String1="IF", _String2="tasklist") returned -11 [0082.257] _wcsicmp (_String1="IF/?", _String2="tasklist") returned -11 [0082.257] _wcsicmp (_String1="REM", _String2="tasklist") returned -2 [0082.257] _wcsicmp (_String1="REM/?", _String2="tasklist") returned -2 [0082.257] GetProcessHeap () returned 0x790000 [0082.257] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0x58) returned 0x791120 [0082.257] GetProcessHeap () returned 0x790000 [0082.257] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0x1a) returned 0x790830 [0082.257] GetProcessHeap () returned 0x790000 [0082.257] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0x20) returned 0x790858 [0082.257] GetProcessHeap () returned 0x790000 [0082.257] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0x20) returned 0x790880 [0082.262] GetProcessHeap () returned 0x790000 [0082.262] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0xf6) returned 0x791180 [0082.263] GetProcessHeap () returned 0x790000 [0082.263] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0x18) returned 0x791280 [0082.263] _get_osfhandle (_FileHandle=1) returned 0x7 [0082.263] _get_osfhandle (_FileHandle=1) returned 0x7 [0082.263] _get_osfhandle (_FileHandle=1) returned 0x7 [0082.263] GetFileType (hFile=0x7) returned 0x2 [0082.264] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0082.264] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x32fa50 | out: lpMode=0x32fa50) returned 1 [0082.264] _dup (_FileHandle=1) returned 3 [0082.264] _close (_FileHandle=1) returned 0 [0082.264] _wcsicmp (_String1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\processes.txt", _String2="con") returned -53 [0082.265] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\processes.txt" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\processes.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x32fa20, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0082.323] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 1 [0082.323] GetConsoleTitleW (in: lpConsoleTitle=0x32f850, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0082.324] _wcsicmp (_String1="tasklist", _String2="DIR") returned 16 [0082.324] _wcsicmp (_String1="tasklist", _String2="ERASE") returned 15 [0082.324] _wcsicmp (_String1="tasklist", _String2="DEL") returned 16 [0082.324] _wcsicmp (_String1="tasklist", _String2="TYPE") returned -24 [0082.324] _wcsicmp (_String1="tasklist", _String2="COPY") returned 17 [0082.324] _wcsicmp (_String1="tasklist", _String2="CD") returned 17 [0082.324] _wcsicmp (_String1="tasklist", _String2="CHDIR") returned 17 [0082.324] _wcsicmp (_String1="tasklist", _String2="RENAME") returned 2 [0082.324] _wcsicmp (_String1="tasklist", _String2="REN") returned 2 [0082.325] _wcsicmp (_String1="tasklist", _String2="ECHO") returned 15 [0082.325] _wcsicmp (_String1="tasklist", _String2="SET") returned 1 [0082.325] _wcsicmp (_String1="tasklist", _String2="PAUSE") returned 4 [0082.325] _wcsicmp (_String1="tasklist", _String2="DATE") returned 16 [0082.325] _wcsicmp (_String1="tasklist", _String2="TIME") returned -8 [0082.325] _wcsicmp (_String1="tasklist", _String2="PROMPT") returned 4 [0082.325] _wcsicmp (_String1="tasklist", _String2="MD") returned 7 [0082.325] _wcsicmp (_String1="tasklist", _String2="MKDIR") returned 7 [0082.325] _wcsicmp (_String1="tasklist", _String2="RD") returned 2 [0082.325] _wcsicmp (_String1="tasklist", _String2="RMDIR") returned 2 [0082.325] _wcsicmp (_String1="tasklist", _String2="PATH") returned 4 [0082.325] _wcsicmp (_String1="tasklist", _String2="GOTO") returned 13 [0082.325] _wcsicmp (_String1="tasklist", _String2="SHIFT") returned 1 [0082.325] _wcsicmp (_String1="tasklist", _String2="CLS") returned 17 [0082.325] _wcsicmp (_String1="tasklist", _String2="CALL") returned 17 [0082.325] _wcsicmp (_String1="tasklist", _String2="VERIFY") returned -2 [0082.325] _wcsicmp (_String1="tasklist", _String2="VER") returned -2 [0082.325] _wcsicmp (_String1="tasklist", _String2="VOL") returned -2 [0082.325] _wcsicmp (_String1="tasklist", _String2="EXIT") returned 15 [0082.325] _wcsicmp (_String1="tasklist", _String2="SETLOCAL") returned 1 [0082.325] _wcsicmp (_String1="tasklist", _String2="ENDLOCAL") returned 15 [0082.325] _wcsicmp (_String1="tasklist", _String2="TITLE") returned -8 [0082.325] _wcsicmp (_String1="tasklist", _String2="START") returned 1 [0082.325] _wcsicmp (_String1="tasklist", _String2="DPATH") returned 16 [0082.325] _wcsicmp (_String1="tasklist", _String2="KEYS") returned 9 [0082.326] _wcsicmp (_String1="tasklist", _String2="MOVE") returned 7 [0082.326] _wcsicmp (_String1="tasklist", _String2="PUSHD") returned 4 [0082.326] _wcsicmp (_String1="tasklist", _String2="POPD") returned 4 [0082.326] _wcsicmp (_String1="tasklist", _String2="ASSOC") returned 19 [0082.326] _wcsicmp (_String1="tasklist", _String2="FTYPE") returned 14 [0082.326] _wcsicmp (_String1="tasklist", _String2="BREAK") returned 18 [0082.326] _wcsicmp (_String1="tasklist", _String2="COLOR") returned 17 [0082.326] _wcsicmp (_String1="tasklist", _String2="MKLINK") returned 7 [0082.326] _wcsicmp (_String1="tasklist", _String2="DIR") returned 16 [0082.326] _wcsicmp (_String1="tasklist", _String2="ERASE") returned 15 [0082.326] _wcsicmp (_String1="tasklist", _String2="DEL") returned 16 [0082.326] _wcsicmp (_String1="tasklist", _String2="TYPE") returned -24 [0082.326] _wcsicmp (_String1="tasklist", _String2="COPY") returned 17 [0082.326] _wcsicmp (_String1="tasklist", _String2="CD") returned 17 [0082.326] _wcsicmp (_String1="tasklist", _String2="CHDIR") returned 17 [0082.326] _wcsicmp (_String1="tasklist", _String2="RENAME") returned 2 [0082.326] _wcsicmp (_String1="tasklist", _String2="REN") returned 2 [0082.326] _wcsicmp (_String1="tasklist", _String2="ECHO") returned 15 [0082.326] _wcsicmp (_String1="tasklist", _String2="SET") returned 1 [0082.326] _wcsicmp (_String1="tasklist", _String2="PAUSE") returned 4 [0082.326] _wcsicmp (_String1="tasklist", _String2="DATE") returned 16 [0082.326] _wcsicmp (_String1="tasklist", _String2="TIME") returned -8 [0082.326] _wcsicmp (_String1="tasklist", _String2="PROMPT") returned 4 [0082.326] _wcsicmp (_String1="tasklist", _String2="MD") returned 7 [0082.326] _wcsicmp (_String1="tasklist", _String2="MKDIR") returned 7 [0082.327] _wcsicmp (_String1="tasklist", _String2="RD") returned 2 [0082.327] _wcsicmp (_String1="tasklist", _String2="RMDIR") returned 2 [0082.327] _wcsicmp (_String1="tasklist", _String2="PATH") returned 4 [0082.327] _wcsicmp (_String1="tasklist", _String2="GOTO") returned 13 [0082.327] _wcsicmp (_String1="tasklist", _String2="SHIFT") returned 1 [0082.327] _wcsicmp (_String1="tasklist", _String2="CLS") returned 17 [0082.327] _wcsicmp (_String1="tasklist", _String2="CALL") returned 17 [0082.327] _wcsicmp (_String1="tasklist", _String2="VERIFY") returned -2 [0082.327] _wcsicmp (_String1="tasklist", _String2="VER") returned -2 [0082.327] _wcsicmp (_String1="tasklist", _String2="VOL") returned -2 [0082.327] _wcsicmp (_String1="tasklist", _String2="EXIT") returned 15 [0082.327] _wcsicmp (_String1="tasklist", _String2="SETLOCAL") returned 1 [0082.327] _wcsicmp (_String1="tasklist", _String2="ENDLOCAL") returned 15 [0082.327] _wcsicmp (_String1="tasklist", _String2="TITLE") returned -8 [0082.327] _wcsicmp (_String1="tasklist", _String2="START") returned 1 [0082.327] _wcsicmp (_String1="tasklist", _String2="DPATH") returned 16 [0082.327] _wcsicmp (_String1="tasklist", _String2="KEYS") returned 9 [0082.327] _wcsicmp (_String1="tasklist", _String2="MOVE") returned 7 [0082.327] _wcsicmp (_String1="tasklist", _String2="PUSHD") returned 4 [0082.327] _wcsicmp (_String1="tasklist", _String2="POPD") returned 4 [0082.327] _wcsicmp (_String1="tasklist", _String2="ASSOC") returned 19 [0082.327] _wcsicmp (_String1="tasklist", _String2="FTYPE") returned 14 [0082.327] _wcsicmp (_String1="tasklist", _String2="BREAK") returned 18 [0082.327] _wcsicmp (_String1="tasklist", _String2="COLOR") returned 17 [0082.327] _wcsicmp (_String1="tasklist", _String2="MKLINK") returned 7 [0082.327] _wcsicmp (_String1="tasklist", _String2="FOR") returned 14 [0082.328] _wcsicmp (_String1="tasklist", _String2="IF") returned 11 [0082.328] _wcsicmp (_String1="tasklist", _String2="REM") returned 2 [0082.328] GetProcessHeap () returned 0x790000 [0082.328] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0x210) returned 0x7a30f8 [0082.328] GetProcessHeap () returned 0x790000 [0082.328] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0x32) returned 0x7a3310 [0082.328] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17 [0082.329] GetProcessHeap () returned 0x790000 [0082.329] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0x418) returned 0x7a4210 [0082.329] SetErrorMode (uMode=0x0) returned 0x0 [0082.329] SetErrorMode (uMode=0x1) returned 0x0 [0082.329] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x7a4218, lpFilePart=0x32f370 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x32f370*="Desktop") returned 0x25 [0082.329] SetErrorMode (uMode=0x0) returned 0x1 [0082.329] GetProcessHeap () returned 0x790000 [0082.329] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7a4210, Size=0x66) returned 0x7a4210 [0082.329] GetProcessHeap () returned 0x790000 [0082.329] RtlSizeHeap (HeapHandle=0x790000, Flags=0x0, MemoryPointer=0x7a4210) returned 0x66 [0082.329] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a270640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0082.329] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0082.329] GetProcessHeap () returned 0x790000 [0082.329] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0x120) returned 0x7a3350 [0082.329] GetProcessHeap () returned 0x790000 [0082.329] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0x238) returned 0x7a3478 [0082.336] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7a3478, Size=0x122) returned 0x7a3478 [0082.336] GetProcessHeap () returned 0x790000 [0082.336] RtlSizeHeap (HeapHandle=0x790000, Flags=0x0, MemoryPointer=0x7a3478) returned 0x122 [0082.336] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a270640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0082.336] GetProcessHeap () returned 0x790000 [0082.336] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0xe0) returned 0x7a35a8 [0082.336] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7a35a8, Size=0x76) returned 0x7a35a8 [0082.336] GetProcessHeap () returned 0x790000 [0082.336] RtlSizeHeap (HeapHandle=0x790000, Flags=0x0, MemoryPointer=0x7a35a8) returned 0x76 [0082.336] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0082.336] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\tasklist.*", fInfoLevelId=0x1, lpFindFileData=0x32f0ec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32f0ec) returned 0xffffffff [0082.336] GetLastError () returned 0x2 [0082.336] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\tasklist", fInfoLevelId=0x1, lpFindFileData=0x32f0ec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32f0ec) returned 0xffffffff [0082.336] GetLastError () returned 0x2 [0082.336] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0082.336] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\tasklist.*", fInfoLevelId=0x1, lpFindFileData=0x32f0ec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32f0ec) returned 0x7a3628 [0082.387] GetProcessHeap () returned 0x790000 [0082.387] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x14) returned 0x7912a0 [0082.387] FindClose (in: hFindFile=0x7a3628 | out: hFindFile=0x7a3628) returned 1 [0082.387] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\tasklist.COM", fInfoLevelId=0x1, lpFindFileData=0x32f0ec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32f0ec) returned 0xffffffff [0082.387] GetLastError () returned 0x2 [0082.387] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\tasklist.EXE", fInfoLevelId=0x1, lpFindFileData=0x32f0ec, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x32f0ec) returned 0x7a3628 [0082.387] GetProcessHeap () returned 0x790000 [0082.387] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7912a0, Size=0x4) returned 0x7912a0 [0082.387] FindClose (in: hFindFile=0x7a3628 | out: hFindFile=0x7a3628) returned 1 [0082.388] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0082.388] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0082.388] GetConsoleTitleW (in: lpConsoleTitle=0x32f5e4, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0082.388] InitializeProcThreadAttributeList (in: lpAttributeList=0x32f46c, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x32f534 | out: lpAttributeList=0x32f46c, lpSize=0x32f534) returned 1 [0082.388] UpdateProcThreadAttribute (in: lpAttributeList=0x32f46c, dwFlags=0x0, Attribute=0x60001, lpValue=0x32f52c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x32f46c, lpPreviousValue=0x0) returned 1 [0082.388] GetStartupInfoW (in: lpStartupInfo=0x32f428 | out: lpStartupInfo=0x32f428*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0082.388] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0x18) returned 0x7a3628 [0082.388] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0082.388] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0082.388] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0082.388] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0082.388] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0082.388] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0082.388] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0082.388] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0082.388] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0082.388] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0082.388] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0082.388] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0082.388] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0082.388] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0082.388] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0082.388] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0082.388] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0082.389] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0082.389] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0082.389] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0082.389] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0082.389] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0082.389] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0082.389] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0082.389] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0082.389] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0082.389] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0082.389] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0082.389] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0082.389] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0082.389] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0082.389] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0082.389] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0082.389] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0082.389] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0082.389] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0082.389] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0082.389] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0082.389] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0082.389] GetProcessHeap () returned 0x790000 [0082.389] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7a3628 | out: hHeap=0x790000) returned 1 [0082.389] GetProcessHeap () returned 0x790000 [0082.389] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0xa) returned 0x7a0068 [0082.389] lstrcmpW (lpString1="\\tasklist.exe", lpString2="\\XCOPY.EXE") returned -1 [0082.391] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\tasklist.exe", lpCommandLine="tasklist /FO TABLE ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x32f4c8*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="tasklist /FO TABLE ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x32f514 | out: lpCommandLine="tasklist /FO TABLE ", lpProcessInformation=0x32f514*(hProcess=0x7c, hThread=0x78, dwProcessId=0xa4c, dwThreadId=0xb0)) returned 1 [0082.447] CloseHandle (hObject=0x78) returned 1 [0082.447] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0082.447] GetProcessHeap () returned 0x790000 [0082.447] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7a5850 | out: hHeap=0x790000) returned 1 [0082.447] GetEnvironmentStringsW () returned 0x7a43f0* [0082.447] GetProcessHeap () returned 0x790000 [0082.447] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0xb36) returned 0x7a4f30 [0082.447] FreeEnvironmentStringsW (penv=0x7a43f0) returned 1 [0082.447] WaitForSingleObject (hHandle=0x7c, dwMilliseconds=0xffffffff) Process: id = "7" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x269ea000" os_pid = "0x97c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xb50" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /c keys.util" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 27 os_tid = 0x98c [0083.576] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1ef7ac | out: lpSystemTimeAsFileTime=0x1ef7ac*(dwLowDateTime=0xf7089d50, dwHighDateTime=0x1d69aea)) [0083.576] GetCurrentProcessId () returned 0x97c [0083.576] GetCurrentThreadId () returned 0x98c [0083.576] GetTickCount () returned 0x114d0f6 [0083.576] QueryPerformanceCounter (in: lpPerformanceCount=0x1ef7a4 | out: lpPerformanceCount=0x1ef7a4*=20320682818) returned 1 [0083.577] GetModuleHandleA (lpModuleName=0x0) returned 0x4a240000 [0083.577] __set_app_type (_Type=0x1) [0083.577] __p__fmode () returned 0x770331f4 [0083.577] __p__commode () returned 0x770331fc [0083.578] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a2621a6) returned 0x0 [0083.578] __getmainargs (in: _Argc=0x4a264238, _Argv=0x4a264240, _Env=0x4a26423c, _DoWildCard=0, _StartInfo=0x4a264140 | out: _Argc=0x4a264238, _Argv=0x4a264240, _Env=0x4a26423c) returned 0 [0083.578] GetCurrentThreadId () returned 0x98c [0083.578] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x98c) returned 0x60 [0083.578] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0083.578] GetProcAddress (hModule=0x76d30000, lpProcName="SetThreadUILanguage") returned 0x76d5a84f [0083.578] SetThreadUILanguage (LangId=0x0) returned 0x409 [0083.579] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0083.579] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ef73c | out: phkResult=0x1ef73c*=0x0) returned 0x2 [0083.579] VirtualQuery (in: lpAddress=0x1ef773, lpBuffer=0x1ef70c, dwLength=0x1c | out: lpBuffer=0x1ef70c*(BaseAddress=0x1ef000, AllocationBase=0xf0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0083.579] VirtualQuery (in: lpAddress=0xf0000, lpBuffer=0x1ef70c, dwLength=0x1c | out: lpBuffer=0x1ef70c*(BaseAddress=0xf0000, AllocationBase=0xf0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0083.579] VirtualQuery (in: lpAddress=0xf1000, lpBuffer=0x1ef70c, dwLength=0x1c | out: lpBuffer=0x1ef70c*(BaseAddress=0xf1000, AllocationBase=0xf0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0083.579] VirtualQuery (in: lpAddress=0xf3000, lpBuffer=0x1ef70c, dwLength=0x1c | out: lpBuffer=0x1ef70c*(BaseAddress=0xf3000, AllocationBase=0xf0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0083.579] VirtualQuery (in: lpAddress=0x1f0000, lpBuffer=0x1ef70c, dwLength=0x1c | out: lpBuffer=0x1ef70c*(BaseAddress=0x1f0000, AllocationBase=0x1f0000, AllocationProtect=0x2, RegionSize=0x67000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0083.579] GetConsoleOutputCP () returned 0x1b5 [0083.579] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a264260 | out: lpCPInfo=0x4a264260) returned 1 [0083.579] SetConsoleCtrlHandler (HandlerRoutine=0x4a25e72a, Add=1) returned 1 [0083.579] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.579] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0083.580] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.580] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a2641ac | out: lpMode=0x4a2641ac) returned 1 [0083.580] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.580] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0083.580] _get_osfhandle (_FileHandle=0) returned 0x3 [0083.580] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a2641b0 | out: lpMode=0x4a2641b0) returned 1 [0083.580] _get_osfhandle (_FileHandle=0) returned 0x3 [0083.580] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0083.581] GetEnvironmentStringsW () returned 0x3e2010* [0083.581] GetProcessHeap () returned 0x3d0000 [0083.581] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0xaca) returned 0x3e2ae8 [0083.581] FreeEnvironmentStringsW (penv=0x3e2010) returned 1 [0083.581] GetProcessHeap () returned 0x3d0000 [0083.581] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x4) returned 0x3e0c48 [0083.581] GetEnvironmentStringsW () returned 0x3e2010* [0083.581] GetProcessHeap () returned 0x3d0000 [0083.581] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0xaca) returned 0x3e35c0 [0083.581] FreeEnvironmentStringsW (penv=0x3e2010) returned 1 [0083.581] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1ee6ac | out: phkResult=0x1ee6ac*=0x68) returned 0x0 [0083.581] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1ee6b4, lpData=0x1ee6b8, lpcbData=0x1ee6b0*=0x1000 | out: lpType=0x1ee6b4*=0x0, lpData=0x1ee6b8*=0x0, lpcbData=0x1ee6b0*=0x1000) returned 0x2 [0083.582] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1ee6b4, lpData=0x1ee6b8, lpcbData=0x1ee6b0*=0x1000 | out: lpType=0x1ee6b4*=0x4, lpData=0x1ee6b8*=0x1, lpcbData=0x1ee6b0*=0x4) returned 0x0 [0083.582] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1ee6b4, lpData=0x1ee6b8, lpcbData=0x1ee6b0*=0x1000 | out: lpType=0x1ee6b4*=0x0, lpData=0x1ee6b8*=0x1, lpcbData=0x1ee6b0*=0x1000) returned 0x2 [0083.582] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1ee6b4, lpData=0x1ee6b8, lpcbData=0x1ee6b0*=0x1000 | out: lpType=0x1ee6b4*=0x4, lpData=0x1ee6b8*=0x0, lpcbData=0x1ee6b0*=0x4) returned 0x0 [0083.582] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1ee6b4, lpData=0x1ee6b8, lpcbData=0x1ee6b0*=0x1000 | out: lpType=0x1ee6b4*=0x4, lpData=0x1ee6b8*=0x40, lpcbData=0x1ee6b0*=0x4) returned 0x0 [0083.582] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1ee6b4, lpData=0x1ee6b8, lpcbData=0x1ee6b0*=0x1000 | out: lpType=0x1ee6b4*=0x4, lpData=0x1ee6b8*=0x40, lpcbData=0x1ee6b0*=0x4) returned 0x0 [0083.582] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1ee6b4, lpData=0x1ee6b8, lpcbData=0x1ee6b0*=0x1000 | out: lpType=0x1ee6b4*=0x0, lpData=0x1ee6b8*=0x40, lpcbData=0x1ee6b0*=0x1000) returned 0x2 [0083.582] RegCloseKey (hKey=0x68) returned 0x0 [0083.582] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1ee6ac | out: phkResult=0x1ee6ac*=0x68) returned 0x0 [0083.582] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1ee6b4, lpData=0x1ee6b8, lpcbData=0x1ee6b0*=0x1000 | out: lpType=0x1ee6b4*=0x0, lpData=0x1ee6b8*=0x40, lpcbData=0x1ee6b0*=0x1000) returned 0x2 [0083.582] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1ee6b4, lpData=0x1ee6b8, lpcbData=0x1ee6b0*=0x1000 | out: lpType=0x1ee6b4*=0x4, lpData=0x1ee6b8*=0x1, lpcbData=0x1ee6b0*=0x4) returned 0x0 [0083.582] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1ee6b4, lpData=0x1ee6b8, lpcbData=0x1ee6b0*=0x1000 | out: lpType=0x1ee6b4*=0x0, lpData=0x1ee6b8*=0x1, lpcbData=0x1ee6b0*=0x1000) returned 0x2 [0083.582] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1ee6b4, lpData=0x1ee6b8, lpcbData=0x1ee6b0*=0x1000 | out: lpType=0x1ee6b4*=0x4, lpData=0x1ee6b8*=0x0, lpcbData=0x1ee6b0*=0x4) returned 0x0 [0083.582] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1ee6b4, lpData=0x1ee6b8, lpcbData=0x1ee6b0*=0x1000 | out: lpType=0x1ee6b4*=0x4, lpData=0x1ee6b8*=0x9, lpcbData=0x1ee6b0*=0x4) returned 0x0 [0083.582] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1ee6b4, lpData=0x1ee6b8, lpcbData=0x1ee6b0*=0x1000 | out: lpType=0x1ee6b4*=0x4, lpData=0x1ee6b8*=0x9, lpcbData=0x1ee6b0*=0x4) returned 0x0 [0083.582] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1ee6b4, lpData=0x1ee6b8, lpcbData=0x1ee6b0*=0x1000 | out: lpType=0x1ee6b4*=0x0, lpData=0x1ee6b8*=0x9, lpcbData=0x1ee6b0*=0x1000) returned 0x2 [0083.582] RegCloseKey (hKey=0x68) returned 0x0 [0083.582] time (in: timer=0x0 | out: timer=0x0) returned 0x5f7ace35 [0083.582] srand (_Seed=0x5f7ace35) [0083.582] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c keys.util" [0083.582] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c keys.util" [0083.583] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a265260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0083.583] GetProcessHeap () returned 0x3d0000 [0083.583] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x210) returned 0x3e2010 [0083.583] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3e2018, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0083.583] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a270640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0083.583] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a270640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0083.583] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a270640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0083.583] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0083.583] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0083.583] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0083.583] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0083.583] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0083.583] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0083.583] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0083.583] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0083.584] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0083.584] GetProcessHeap () returned 0x3d0000 [0083.584] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e2ae8 | out: hHeap=0x3d0000) returned 1 [0083.584] GetEnvironmentStringsW () returned 0x3e2228* [0083.584] GetProcessHeap () returned 0x3d0000 [0083.584] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0xae2) returned 0x3e4b88 [0083.584] FreeEnvironmentStringsW (penv=0x3e2228) returned 1 [0083.584] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a270640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0083.584] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a270640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0083.584] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0083.584] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0083.584] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0083.584] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0083.584] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0083.584] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0083.584] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0083.584] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0083.584] GetProcessHeap () returned 0x3d0000 [0083.584] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x54) returned 0x3e5678 [0083.584] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1ef478 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0083.584] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x1ef478, lpFilePart=0x1ef474 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1ef474*="Desktop") returned 0x25 [0083.584] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0083.585] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x1ef1f4 | out: lpFindFileData=0x1ef1f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x3e1e90 [0083.585] FindClose (in: hFindFile=0x3e1e90 | out: hFindFile=0x3e1e90) returned 1 [0083.585] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x1ef1f4 | out: lpFindFileData=0x1ef1f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x3e1e90 [0083.585] FindClose (in: hFindFile=0x3e1e90 | out: hFindFile=0x3e1e90) returned 1 [0083.585] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0083.585] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x1ef1f4 | out: lpFindFileData=0x1ef1f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf53d33f0, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf53d33f0, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x3e1e90 [0083.585] FindClose (in: hFindFile=0x3e1e90 | out: hFindFile=0x3e1e90) returned 1 [0083.585] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0083.585] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0083.586] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0083.586] GetProcessHeap () returned 0x3d0000 [0083.586] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e4b88 | out: hHeap=0x3d0000) returned 1 [0083.586] GetEnvironmentStringsW () returned 0x3e4098* [0083.586] GetProcessHeap () returned 0x3d0000 [0083.586] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0xb36) returned 0x3e5ed8 [0083.586] FreeEnvironmentStringsW (penv=0x3e4098) returned 1 [0083.586] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a265260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0083.586] GetProcessHeap () returned 0x3d0000 [0083.586] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5678 | out: hHeap=0x3d0000) returned 1 [0083.586] GetProcessHeap () returned 0x3d0000 [0083.586] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x400e) returned 0x3e6a18 [0083.586] GetProcessHeap () returned 0x3d0000 [0083.586] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x20) returned 0x3e5718 [0083.587] GetProcessHeap () returned 0x3d0000 [0083.587] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e6a18 | out: hHeap=0x3d0000) returned 1 [0083.587] GetConsoleOutputCP () returned 0x1b5 [0083.587] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a264260 | out: lpCPInfo=0x4a264260) returned 1 [0083.587] GetUserDefaultLCID () returned 0x409 [0083.587] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a264950, cchData=8 | out: lpLCData=":") returned 2 [0083.588] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x1ef5b8, cchData=128 | out: lpLCData="0") returned 2 [0083.588] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x1ef5b8, cchData=128 | out: lpLCData="0") returned 2 [0083.588] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x1ef5b8, cchData=128 | out: lpLCData="1") returned 2 [0083.588] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a264940, cchData=8 | out: lpLCData="/") returned 2 [0083.588] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a264d80, cchData=32 | out: lpLCData="Mon") returned 4 [0083.588] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a264d40, cchData=32 | out: lpLCData="Tue") returned 4 [0083.588] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a264d00, cchData=32 | out: lpLCData="Wed") returned 4 [0083.588] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a264cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0083.588] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a264c80, cchData=32 | out: lpLCData="Fri") returned 4 [0083.588] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a264c40, cchData=32 | out: lpLCData="Sat") returned 4 [0083.588] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a264c00, cchData=32 | out: lpLCData="Sun") returned 4 [0083.588] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a264930, cchData=8 | out: lpLCData=".") returned 2 [0083.588] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a264920, cchData=8 | out: lpLCData=",") returned 2 [0083.588] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0083.590] GetProcessHeap () returned 0x3d0000 [0083.590] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x20c) returned 0x3e2d68 [0083.590] GetConsoleTitleW (in: lpConsoleTitle=0x3e2d68, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0083.590] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0083.590] GetProcAddress (hModule=0x76d30000, lpProcName="CopyFileExW") returned 0x76d63b92 [0083.590] GetProcAddress (hModule=0x76d30000, lpProcName="IsDebuggerPresent") returned 0x76d44a5d [0083.590] GetProcAddress (hModule=0x76d30000, lpProcName="SetConsoleInputExeNameW") returned 0x76d5a79d [0083.591] GetProcessHeap () returned 0x3d0000 [0083.591] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x400a) returned 0x3e6a18 [0083.591] GetProcessHeap () returned 0x3d0000 [0083.591] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e6a18 | out: hHeap=0x3d0000) returned 1 [0083.591] _wcsicmp (_String1="keys.util", _String2=")") returned 66 [0083.591] _wcsicmp (_String1="FOR", _String2="keys.util") returned -5 [0083.591] _wcsicmp (_String1="FOR/?", _String2="keys.util") returned -5 [0083.592] _wcsicmp (_String1="IF", _String2="keys.util") returned -2 [0083.592] _wcsicmp (_String1="IF/?", _String2="keys.util") returned -2 [0083.592] _wcsicmp (_String1="REM", _String2="keys.util") returned 7 [0083.592] _wcsicmp (_String1="REM/?", _String2="keys.util") returned 7 [0083.592] GetProcessHeap () returned 0x3d0000 [0083.592] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x58) returned 0x3e2f80 [0083.592] GetProcessHeap () returned 0x3d0000 [0083.592] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x1c) returned 0x3e5740 [0083.592] GetConsoleTitleW (in: lpConsoleTitle=0x1ef2b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0083.593] GetFileAttributesW (lpFileName="keys.util" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\keys.util")) returned 0x2 [0083.593] _wcsicmp (_String1="keys.util", _String2="DIR") returned 7 [0083.593] _wcsicmp (_String1="keys.util", _String2="ERASE") returned 6 [0083.593] _wcsicmp (_String1="keys.util", _String2="DEL") returned 7 [0083.593] _wcsicmp (_String1="keys.util", _String2="TYPE") returned -9 [0083.593] _wcsicmp (_String1="keys.util", _String2="COPY") returned 8 [0083.593] _wcsicmp (_String1="keys.util", _String2="CD") returned 8 [0083.593] _wcsicmp (_String1="keys.util", _String2="CHDIR") returned 8 [0083.593] _wcsicmp (_String1="keys.util", _String2="RENAME") returned -7 [0083.593] _wcsicmp (_String1="keys.util", _String2="REN") returned -7 [0083.593] _wcsicmp (_String1="keys.util", _String2="ECHO") returned 6 [0083.593] _wcsicmp (_String1="keys.util", _String2="SET") returned -8 [0083.593] _wcsicmp (_String1="keys.util", _String2="PAUSE") returned -5 [0083.594] _wcsicmp (_String1="keys.util", _String2="DATE") returned 7 [0083.594] _wcsicmp (_String1="keys.util", _String2="TIME") returned -9 [0083.594] _wcsicmp (_String1="keys.util", _String2="PROMPT") returned -5 [0083.594] _wcsicmp (_String1="keys.util", _String2="MD") returned -2 [0083.594] _wcsicmp (_String1="keys.util", _String2="MKDIR") returned -2 [0083.594] _wcsicmp (_String1="keys.util", _String2="RD") returned -7 [0083.594] _wcsicmp (_String1="keys.util", _String2="RMDIR") returned -7 [0083.594] _wcsicmp (_String1="keys.util", _String2="PATH") returned -5 [0083.594] _wcsicmp (_String1="keys.util", _String2="GOTO") returned 4 [0083.594] _wcsicmp (_String1="keys.util", _String2="SHIFT") returned -8 [0083.594] _wcsicmp (_String1="keys.util", _String2="CLS") returned 8 [0083.594] _wcsicmp (_String1="keys.util", _String2="CALL") returned 8 [0083.594] _wcsicmp (_String1="keys.util", _String2="VERIFY") returned -11 [0083.594] _wcsicmp (_String1="keys.util", _String2="VER") returned -11 [0083.594] _wcsicmp (_String1="keys.util", _String2="VOL") returned -11 [0083.594] _wcsicmp (_String1="keys.util", _String2="EXIT") returned 6 [0083.594] _wcsicmp (_String1="keys.util", _String2="SETLOCAL") returned -8 [0083.594] _wcsicmp (_String1="keys.util", _String2="ENDLOCAL") returned 6 [0083.594] _wcsicmp (_String1="keys.util", _String2="TITLE") returned -9 [0083.594] _wcsicmp (_String1="keys.util", _String2="START") returned -8 [0083.594] _wcsicmp (_String1="keys.util", _String2="DPATH") returned 7 [0083.594] _wcsicmp (_String1="keys.util", _String2="KEYS") returned 46 [0083.594] _wcsicmp (_String1="keys.util", _String2="MOVE") returned -2 [0083.594] _wcsicmp (_String1="keys.util", _String2="PUSHD") returned -5 [0083.594] _wcsicmp (_String1="keys.util", _String2="POPD") returned -5 [0083.594] _wcsicmp (_String1="keys.util", _String2="ASSOC") returned 10 [0083.594] _wcsicmp (_String1="keys.util", _String2="FTYPE") returned 5 [0083.594] _wcsicmp (_String1="keys.util", _String2="BREAK") returned 9 [0083.594] _wcsicmp (_String1="keys.util", _String2="COLOR") returned 8 [0083.594] _wcsicmp (_String1="keys.util", _String2="MKLINK") returned -2 [0083.594] _wcsicmp (_String1="keys.util", _String2="DIR") returned 7 [0083.594] _wcsicmp (_String1="keys.util", _String2="ERASE") returned 6 [0083.594] _wcsicmp (_String1="keys.util", _String2="DEL") returned 7 [0083.594] _wcsicmp (_String1="keys.util", _String2="TYPE") returned -9 [0083.595] _wcsicmp (_String1="keys.util", _String2="COPY") returned 8 [0083.595] _wcsicmp (_String1="keys.util", _String2="CD") returned 8 [0083.595] _wcsicmp (_String1="keys.util", _String2="CHDIR") returned 8 [0083.595] _wcsicmp (_String1="keys.util", _String2="RENAME") returned -7 [0083.595] _wcsicmp (_String1="keys.util", _String2="REN") returned -7 [0083.595] _wcsicmp (_String1="keys.util", _String2="ECHO") returned 6 [0083.595] _wcsicmp (_String1="keys.util", _String2="SET") returned -8 [0083.595] _wcsicmp (_String1="keys.util", _String2="PAUSE") returned -5 [0083.595] _wcsicmp (_String1="keys.util", _String2="DATE") returned 7 [0083.595] _wcsicmp (_String1="keys.util", _String2="TIME") returned -9 [0083.595] _wcsicmp (_String1="keys.util", _String2="PROMPT") returned -5 [0083.595] _wcsicmp (_String1="keys.util", _String2="MD") returned -2 [0083.595] _wcsicmp (_String1="keys.util", _String2="MKDIR") returned -2 [0083.595] _wcsicmp (_String1="keys.util", _String2="RD") returned -7 [0083.595] _wcsicmp (_String1="keys.util", _String2="RMDIR") returned -7 [0083.595] _wcsicmp (_String1="keys.util", _String2="PATH") returned -5 [0083.595] _wcsicmp (_String1="keys.util", _String2="GOTO") returned 4 [0083.595] _wcsicmp (_String1="keys.util", _String2="SHIFT") returned -8 [0083.595] _wcsicmp (_String1="keys.util", _String2="CLS") returned 8 [0083.595] _wcsicmp (_String1="keys.util", _String2="CALL") returned 8 [0083.595] _wcsicmp (_String1="keys.util", _String2="VERIFY") returned -11 [0083.595] _wcsicmp (_String1="keys.util", _String2="VER") returned -11 [0083.595] _wcsicmp (_String1="keys.util", _String2="VOL") returned -11 [0083.595] _wcsicmp (_String1="keys.util", _String2="EXIT") returned 6 [0083.595] _wcsicmp (_String1="keys.util", _String2="SETLOCAL") returned -8 [0083.595] _wcsicmp (_String1="keys.util", _String2="ENDLOCAL") returned 6 [0083.595] _wcsicmp (_String1="keys.util", _String2="TITLE") returned -9 [0083.595] _wcsicmp (_String1="keys.util", _String2="START") returned -8 [0083.595] _wcsicmp (_String1="keys.util", _String2="DPATH") returned 7 [0083.595] _wcsicmp (_String1="keys.util", _String2="KEYS") returned 46 [0083.595] _wcsicmp (_String1="keys.util", _String2="MOVE") returned -2 [0083.595] _wcsicmp (_String1="keys.util", _String2="PUSHD") returned -5 [0083.595] _wcsicmp (_String1="keys.util", _String2="POPD") returned -5 [0083.595] _wcsicmp (_String1="keys.util", _String2="ASSOC") returned 10 [0083.596] _wcsicmp (_String1="keys.util", _String2="FTYPE") returned 5 [0083.596] _wcsicmp (_String1="keys.util", _String2="BREAK") returned 9 [0083.596] _wcsicmp (_String1="keys.util", _String2="COLOR") returned 8 [0083.596] _wcsicmp (_String1="keys.util", _String2="MKLINK") returned -2 [0083.596] _wcsicmp (_String1="keys.util", _String2="FOR") returned 5 [0083.596] _wcsicmp (_String1="keys.util", _String2="IF") returned 2 [0083.596] _wcsicmp (_String1="keys.util", _String2="REM") returned -7 [0083.596] GetProcessHeap () returned 0x3d0000 [0083.596] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x210) returned 0x3e2fe0 [0083.596] GetProcessHeap () returned 0x3d0000 [0083.596] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x1c) returned 0x3e5768 [0083.596] _wcsnicmp (_String1="keys", _String2="cmd ", _MaxCount=0x4) returned 8 [0083.597] GetProcessHeap () returned 0x3d0000 [0083.597] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x418) returned 0x3d07f0 [0083.597] SetErrorMode (uMode=0x0) returned 0x0 [0083.597] SetErrorMode (uMode=0x1) returned 0x0 [0083.597] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x3d07f8, lpFilePart=0x1eedd0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1eedd0*="Desktop") returned 0x25 [0083.597] SetErrorMode (uMode=0x0) returned 0x1 [0083.597] GetProcessHeap () returned 0x3d0000 [0083.597] RtlReAllocateHeap (Heap=0x3d0000, Flags=0x0, Ptr=0x3d07f0, Size=0x68) returned 0x3d07f0 [0083.597] GetProcessHeap () returned 0x3d0000 [0083.597] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3d07f0) returned 0x68 [0083.597] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a270640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0083.597] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0083.597] GetProcessHeap () returned 0x3d0000 [0083.597] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x120) returned 0x3e31f8 [0083.597] GetProcessHeap () returned 0x3d0000 [0083.597] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x238) returned 0x3e3320 [0083.604] GetProcessHeap () returned 0x3d0000 [0083.604] RtlReAllocateHeap (Heap=0x3d0000, Flags=0x0, Ptr=0x3e3320, Size=0x122) returned 0x3e3320 [0083.604] GetProcessHeap () returned 0x3d0000 [0083.604] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e3320) returned 0x122 [0083.604] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a270640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0083.604] GetProcessHeap () returned 0x3d0000 [0083.604] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0xe0) returned 0x3e3450 [0083.604] GetProcessHeap () returned 0x3d0000 [0083.604] RtlReAllocateHeap (Heap=0x3d0000, Flags=0x0, Ptr=0x3e3450, Size=0x76) returned 0x3e3450 [0083.604] GetProcessHeap () returned 0x3d0000 [0083.604] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e3450) returned 0x76 [0083.605] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0083.605] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\keys.util", fInfoLevelId=0x1, lpFindFileData=0x1eeb6c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1eeb6c) returned 0x3e34d0 [0083.605] GetProcessHeap () returned 0x3d0000 [0083.605] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x14) returned 0x3e3510 [0083.605] FindClose (in: hFindFile=0x3e34d0 | out: hFindFile=0x3e34d0) returned 1 [0083.605] _wcsicmp (_String1=".util", _String2=".CMD") returned 18 [0083.605] _wcsicmp (_String1=".util", _String2=".BAT") returned 19 [0083.605] GetConsoleTitleW (in: lpConsoleTitle=0x1ef044, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0083.605] InitializeProcThreadAttributeList (in: lpAttributeList=0x1eeecc, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1eef94 | out: lpAttributeList=0x1eeecc, lpSize=0x1eef94) returned 1 [0083.605] UpdateProcThreadAttribute (in: lpAttributeList=0x1eeecc, dwFlags=0x0, Attribute=0x60001, lpValue=0x1eef8c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1eeecc, lpPreviousValue=0x0) returned 1 [0083.605] GetStartupInfoW (in: lpStartupInfo=0x1eee88 | out: lpStartupInfo=0x1eee88*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0083.606] GetProcessHeap () returned 0x3d0000 [0083.606] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x18) returned 0x3e34d0 [0083.606] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0083.606] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0083.606] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0083.606] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0083.606] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0083.606] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0083.606] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0083.606] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0083.606] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0083.606] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0083.606] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0083.606] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0083.606] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0083.606] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0083.606] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0083.606] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0083.606] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0083.606] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0083.606] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0083.606] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0083.606] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0083.606] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0083.606] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0083.606] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0083.606] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0083.606] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0083.606] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0083.606] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0083.606] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0083.606] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0083.607] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0083.607] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0083.607] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0083.607] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0083.607] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0083.607] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0083.607] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0083.607] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0083.607] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0083.607] GetProcessHeap () returned 0x3d0000 [0083.607] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e34d0 | out: hHeap=0x3d0000) returned 1 [0083.607] GetProcessHeap () returned 0x3d0000 [0083.607] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0xa) returned 0x3dfee8 [0083.607] lstrcmpW (lpString1="\\keys.util", lpString2="\\XCOPY.EXE") returned -1 [0083.608] CreateProcessW (in: lpApplicationName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\keys.util", lpCommandLine="keys.util", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1eef28*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="keys.util", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1eef74 | out: lpCommandLine="keys.util", lpProcessInformation=0x1eef74*(hProcess=0x78, hThread=0x74, dwProcessId=0xaf8, dwThreadId=0xaf4)) returned 1 [0083.618] CloseHandle (hObject=0x74) returned 1 [0083.618] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0083.618] GetProcessHeap () returned 0x3d0000 [0083.618] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5ed8 | out: hHeap=0x3d0000) returned 1 [0083.618] GetEnvironmentStringsW () returned 0x3e5ed8* [0083.620] GetProcessHeap () returned 0x3d0000 [0083.620] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0xb36) returned 0x3e4098 [0083.620] FreeEnvironmentStringsW (penv=0x3e5ed8) returned 1 [0083.620] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) Process: id = "8" image_name = "netsh.exe" filename = "c:\\windows\\syswow64\\netsh.exe" page_root = "0x1e481000" os_pid = "0x99c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x82c" cmd_line = "netsh wlan show profile " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 28 os_tid = 0x9ac [0084.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x22fa04 | out: lpSystemTimeAsFileTime=0x22fa04*(dwLowDateTime=0xf77fa210, dwHighDateTime=0x1d69aea)) [0084.351] GetCurrentProcessId () returned 0x99c [0084.351] GetCurrentThreadId () returned 0x9ac [0084.351] GetTickCount () returned 0x114d402 [0084.351] QueryPerformanceCounter (in: lpPerformanceCount=0x22f9fc | out: lpPerformanceCount=0x22f9fc*=20398195443) returned 1 [0084.461] GetModuleHandleA (lpModuleName=0x0) returned 0xe50000 [0084.462] __set_app_type (_Type=0x1) [0084.462] __p__fmode () returned 0x770331f4 [0084.462] __p__commode () returned 0x770331fc [0084.462] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xe593ef) returned 0x0 [0084.462] __wgetmainargs (in: _Argc=0xe67ef0, _Argv=0xe67ef8, _Env=0xe67ef4, _DoWildCard=0, _StartInfo=0xe67f00 | out: _Argc=0xe67ef0, _Argv=0xe67ef8, _Env=0xe67ef4) returned 0 [0084.463] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0084.463] GetModuleHandleW (lpModuleName=0x0) returned 0xe50000 [0084.463] _vsnwprintf (in: _Buffer=0xe63ec0, _BufferCount=0x1fff, _Format="%s>", _ArgList=0x227570 | out: _Buffer="netsh>") returned 6 [0084.662] GetProcessHeap () returned 0x590000 [0084.663] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6108 [0084.663] GetProcessHeap () returned 0x590000 [0084.663] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6118 [0084.663] GetProcessHeap () returned 0x590000 [0084.663] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6128 [0084.663] GetProcessHeap () returned 0x590000 [0084.663] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6138 [0084.663] GetProcessHeap () returned 0x590000 [0084.663] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6148 [0084.663] GetProcessHeap () returned 0x590000 [0084.663] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6158 [0084.663] GetProcessHeap () returned 0x590000 [0084.663] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6168 [0084.663] GetProcessHeap () returned 0x590000 [0084.663] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6178 [0084.663] GetProcessHeap () returned 0x590000 [0084.663] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6188 [0084.663] GetProcessHeap () returned 0x590000 [0084.663] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6198 [0084.663] GetProcessHeap () returned 0x590000 [0084.663] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a61a8 [0084.663] GetProcessHeap () returned 0x590000 [0084.663] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a61b8 [0084.664] GetProcessHeap () returned 0x590000 [0084.664] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a61e0 [0084.664] GetProcessHeap () returned 0x590000 [0084.664] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a61f0 [0084.664] GetProcessHeap () returned 0x590000 [0084.664] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6200 [0084.664] GetProcessHeap () returned 0x590000 [0084.664] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6210 [0084.664] GetProcessHeap () returned 0x590000 [0084.664] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6220 [0084.664] GetProcessHeap () returned 0x590000 [0084.664] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6230 [0084.664] GetProcessHeap () returned 0x590000 [0084.664] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6240 [0084.664] GetProcessHeap () returned 0x590000 [0084.664] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6250 [0084.664] GetProcessHeap () returned 0x590000 [0084.664] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6260 [0084.664] GetProcessHeap () returned 0x590000 [0084.664] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6270 [0084.664] GetProcessHeap () returned 0x590000 [0084.664] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6280 [0084.664] GetProcessHeap () returned 0x590000 [0084.664] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6290 [0084.664] GetProcessHeap () returned 0x590000 [0084.664] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a62a0 [0084.664] GetProcessHeap () returned 0x590000 [0084.664] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a62b0 [0084.665] GetProcessHeap () returned 0x590000 [0084.665] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a62c0 [0084.665] GetProcessHeap () returned 0x590000 [0084.665] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a62d0 [0084.665] GetProcessHeap () returned 0x590000 [0084.665] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a62e0 [0084.665] GetProcessHeap () returned 0x590000 [0084.665] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a62f0 [0084.665] GetProcessHeap () returned 0x590000 [0084.665] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6300 [0084.665] GetProcessHeap () returned 0x590000 [0084.665] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6310 [0084.665] GetProcessHeap () returned 0x590000 [0084.665] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6320 [0084.665] GetProcessHeap () returned 0x590000 [0084.665] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6330 [0084.665] GetProcessHeap () returned 0x590000 [0084.665] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6340 [0084.665] GetProcessHeap () returned 0x590000 [0084.665] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6350 [0084.665] GetProcessHeap () returned 0x590000 [0084.665] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6360 [0084.665] GetProcessHeap () returned 0x590000 [0084.665] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6370 [0084.665] GetProcessHeap () returned 0x590000 [0084.665] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6380 [0084.665] GetProcessHeap () returned 0x590000 [0084.665] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6390 [0084.665] GetProcessHeap () returned 0x590000 [0084.665] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a63a0 [0084.666] GetProcessHeap () returned 0x590000 [0084.666] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a63b0 [0084.666] GetProcessHeap () returned 0x590000 [0084.666] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a63c0 [0084.666] GetProcessHeap () returned 0x590000 [0084.666] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a63d0 [0084.666] GetProcessHeap () returned 0x590000 [0084.666] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a63e0 [0084.666] GetProcessHeap () returned 0x590000 [0084.666] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a63f0 [0084.666] GetProcessHeap () returned 0x590000 [0084.666] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6400 [0084.666] GetProcessHeap () returned 0x590000 [0084.666] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6410 [0084.666] GetProcessHeap () returned 0x590000 [0084.666] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6420 [0084.666] GetProcessHeap () returned 0x590000 [0084.666] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6430 [0084.666] GetProcessHeap () returned 0x590000 [0084.666] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6440 [0084.666] GetProcessHeap () returned 0x590000 [0084.666] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6450 [0084.666] GetProcessHeap () returned 0x590000 [0084.666] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6460 [0084.666] GetProcessHeap () returned 0x590000 [0084.666] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6470 [0084.666] GetProcessHeap () returned 0x590000 [0084.666] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6480 [0084.666] GetProcessHeap () returned 0x590000 [0084.667] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6490 [0084.667] GetProcessHeap () returned 0x590000 [0084.667] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a64a0 [0084.667] GetProcessHeap () returned 0x590000 [0084.667] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a64b0 [0084.667] GetProcessHeap () returned 0x590000 [0084.667] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a64c0 [0084.667] GetProcessHeap () returned 0x590000 [0084.667] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a64d0 [0084.667] GetProcessHeap () returned 0x590000 [0084.667] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a64e0 [0084.667] GetProcessHeap () returned 0x590000 [0084.667] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a64f0 [0084.667] GetProcessHeap () returned 0x590000 [0084.667] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6500 [0084.667] GetProcessHeap () returned 0x590000 [0084.667] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6510 [0084.667] GetProcessHeap () returned 0x590000 [0084.667] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6520 [0084.667] GetProcessHeap () returned 0x590000 [0084.667] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6530 [0084.667] GetProcessHeap () returned 0x590000 [0084.667] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6540 [0084.667] GetProcessHeap () returned 0x590000 [0084.667] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6550 [0084.667] GetProcessHeap () returned 0x590000 [0084.667] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6560 [0084.667] GetProcessHeap () returned 0x590000 [0084.667] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6570 [0084.668] GetProcessHeap () returned 0x590000 [0084.668] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6580 [0084.668] GetProcessHeap () returned 0x590000 [0084.668] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6590 [0084.668] GetProcessHeap () returned 0x590000 [0084.668] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a65a0 [0084.668] GetProcessHeap () returned 0x590000 [0084.668] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a65b0 [0084.668] GetProcessHeap () returned 0x590000 [0084.668] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a65e0 [0084.668] GetProcessHeap () returned 0x590000 [0084.668] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a65f0 [0084.668] GetProcessHeap () returned 0x590000 [0084.668] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6600 [0084.668] GetProcessHeap () returned 0x590000 [0084.668] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6610 [0084.668] GetProcessHeap () returned 0x590000 [0084.668] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6620 [0084.668] GetProcessHeap () returned 0x590000 [0084.668] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6630 [0084.668] GetProcessHeap () returned 0x590000 [0084.668] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6640 [0084.668] GetProcessHeap () returned 0x590000 [0084.668] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6650 [0084.668] GetProcessHeap () returned 0x590000 [0084.668] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6660 [0084.668] GetProcessHeap () returned 0x590000 [0084.668] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6670 [0084.668] GetProcessHeap () returned 0x590000 [0084.668] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6680 [0084.669] GetProcessHeap () returned 0x590000 [0084.669] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6690 [0084.669] GetProcessHeap () returned 0x590000 [0084.669] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a66a0 [0084.669] GetProcessHeap () returned 0x590000 [0084.669] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a66b0 [0084.669] GetProcessHeap () returned 0x590000 [0084.669] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a66c0 [0084.669] GetProcessHeap () returned 0x590000 [0084.669] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a66d0 [0084.669] GetProcessHeap () returned 0x590000 [0084.669] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a66e0 [0084.669] GetProcessHeap () returned 0x590000 [0084.669] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a66f0 [0084.669] GetProcessHeap () returned 0x590000 [0084.669] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6700 [0084.669] GetProcessHeap () returned 0x590000 [0084.669] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6710 [0084.669] GetProcessHeap () returned 0x590000 [0084.669] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6720 [0084.669] GetProcessHeap () returned 0x590000 [0084.669] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6730 [0084.669] GetProcessHeap () returned 0x590000 [0084.669] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6740 [0084.669] GetProcessHeap () returned 0x590000 [0084.669] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6750 [0084.669] GetProcessHeap () returned 0x590000 [0084.670] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6760 [0084.670] GetProcessHeap () returned 0x590000 [0084.670] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6770 [0084.670] GetProcessHeap () returned 0x590000 [0084.670] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6780 [0084.670] GetProcessHeap () returned 0x590000 [0084.670] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6790 [0084.670] GetProcessHeap () returned 0x590000 [0084.670] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a67a0 [0084.670] GetProcessHeap () returned 0x590000 [0084.670] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a67b0 [0084.670] GetProcessHeap () returned 0x590000 [0084.670] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a67c0 [0084.670] GetProcessHeap () returned 0x590000 [0084.670] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a67d0 [0084.670] GetProcessHeap () returned 0x590000 [0084.670] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a67e0 [0084.670] GetProcessHeap () returned 0x590000 [0084.670] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a67f0 [0084.670] GetProcessHeap () returned 0x590000 [0084.670] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6800 [0084.670] GetProcessHeap () returned 0x590000 [0084.670] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6810 [0084.670] GetProcessHeap () returned 0x590000 [0084.670] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6820 [0084.670] GetProcessHeap () returned 0x590000 [0084.671] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6830 [0084.671] GetProcessHeap () returned 0x590000 [0084.671] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6840 [0084.671] GetProcessHeap () returned 0x590000 [0084.671] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6850 [0084.671] GetProcessHeap () returned 0x590000 [0084.671] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6860 [0084.671] GetProcessHeap () returned 0x590000 [0084.671] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6870 [0084.671] GetProcessHeap () returned 0x590000 [0084.671] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6880 [0084.671] GetProcessHeap () returned 0x590000 [0084.671] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6890 [0084.671] GetProcessHeap () returned 0x590000 [0084.671] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a68a0 [0084.671] GetProcessHeap () returned 0x590000 [0084.671] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a68b0 [0084.671] GetProcessHeap () returned 0x590000 [0084.671] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a68c0 [0084.671] GetProcessHeap () returned 0x590000 [0084.671] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a68d0 [0084.671] GetProcessHeap () returned 0x590000 [0084.671] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a68e0 [0084.671] GetProcessHeap () returned 0x590000 [0084.671] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a68f0 [0084.671] GetProcessHeap () returned 0x590000 [0084.671] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6900 [0084.671] GetProcessHeap () returned 0x590000 [0084.671] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6910 [0084.671] GetProcessHeap () returned 0x590000 [0084.672] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6920 [0084.672] GetProcessHeap () returned 0x590000 [0084.672] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6930 [0084.672] GetProcessHeap () returned 0x590000 [0084.672] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6940 [0084.672] GetProcessHeap () returned 0x590000 [0084.672] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6950 [0084.672] GetProcessHeap () returned 0x590000 [0084.672] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6960 [0084.672] GetProcessHeap () returned 0x590000 [0084.672] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6970 [0084.672] GetProcessHeap () returned 0x590000 [0084.672] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6980 [0084.672] GetProcessHeap () returned 0x590000 [0084.672] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6990 [0084.672] GetProcessHeap () returned 0x590000 [0084.672] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a69a0 [0084.672] GetProcessHeap () returned 0x590000 [0084.672] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a69b0 [0084.672] GetProcessHeap () returned 0x590000 [0084.672] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a69e0 [0084.672] GetProcessHeap () returned 0x590000 [0084.672] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a69f0 [0084.672] GetProcessHeap () returned 0x590000 [0084.672] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6a00 [0084.672] GetProcessHeap () returned 0x590000 [0084.672] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6a10 [0084.672] GetProcessHeap () returned 0x590000 [0084.673] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6a20 [0084.673] GetProcessHeap () returned 0x590000 [0084.673] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6a30 [0084.673] GetProcessHeap () returned 0x590000 [0084.673] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6a40 [0084.673] GetProcessHeap () returned 0x590000 [0084.673] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6a50 [0084.673] GetProcessHeap () returned 0x590000 [0084.673] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6a60 [0084.673] GetProcessHeap () returned 0x590000 [0084.673] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6a70 [0084.673] GetProcessHeap () returned 0x590000 [0084.673] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6a80 [0084.673] GetProcessHeap () returned 0x590000 [0084.673] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6a90 [0084.673] GetProcessHeap () returned 0x590000 [0084.673] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6aa0 [0084.673] GetProcessHeap () returned 0x590000 [0084.673] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6ab0 [0084.673] GetProcessHeap () returned 0x590000 [0084.673] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6ac0 [0084.673] GetProcessHeap () returned 0x590000 [0084.673] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6ad0 [0084.674] GetProcessHeap () returned 0x590000 [0084.674] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6ae0 [0084.674] GetProcessHeap () returned 0x590000 [0084.674] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6af0 [0084.674] GetProcessHeap () returned 0x590000 [0084.674] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6b00 [0084.674] GetProcessHeap () returned 0x590000 [0084.674] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6b10 [0084.674] GetProcessHeap () returned 0x590000 [0084.674] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6b20 [0084.674] GetProcessHeap () returned 0x590000 [0084.674] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6b30 [0084.674] GetProcessHeap () returned 0x590000 [0084.674] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6b40 [0084.674] GetProcessHeap () returned 0x590000 [0084.674] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6b50 [0084.674] GetProcessHeap () returned 0x590000 [0084.674] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6b60 [0084.674] GetProcessHeap () returned 0x590000 [0084.674] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6b70 [0084.674] GetProcessHeap () returned 0x590000 [0084.674] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6b80 [0084.674] GetProcessHeap () returned 0x590000 [0084.674] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6b90 [0084.674] GetProcessHeap () returned 0x590000 [0084.674] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6ba0 [0084.674] GetProcessHeap () returned 0x590000 [0084.674] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6bb0 [0084.675] GetProcessHeap () returned 0x590000 [0084.675] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6bc0 [0084.675] GetProcessHeap () returned 0x590000 [0084.675] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6bd0 [0084.675] GetProcessHeap () returned 0x590000 [0084.675] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6be0 [0084.675] GetProcessHeap () returned 0x590000 [0084.675] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6bf0 [0084.675] GetProcessHeap () returned 0x590000 [0084.675] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6c00 [0084.675] GetProcessHeap () returned 0x590000 [0084.675] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6c10 [0084.675] GetProcessHeap () returned 0x590000 [0084.675] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6c20 [0084.675] GetProcessHeap () returned 0x590000 [0084.675] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6c30 [0084.675] GetProcessHeap () returned 0x590000 [0084.675] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6c40 [0084.675] GetProcessHeap () returned 0x590000 [0084.675] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6c50 [0084.675] GetProcessHeap () returned 0x590000 [0084.675] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6c60 [0084.675] GetProcessHeap () returned 0x590000 [0084.675] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6c70 [0084.675] GetProcessHeap () returned 0x590000 [0084.675] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6c80 [0084.675] GetProcessHeap () returned 0x590000 [0084.676] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6c90 [0084.676] GetProcessHeap () returned 0x590000 [0084.676] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6ca0 [0084.676] GetProcessHeap () returned 0x590000 [0084.676] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6cb0 [0084.676] GetProcessHeap () returned 0x590000 [0084.676] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6cc0 [0084.676] GetProcessHeap () returned 0x590000 [0084.676] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6cd0 [0084.676] GetProcessHeap () returned 0x590000 [0084.676] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6ce0 [0084.676] GetProcessHeap () returned 0x590000 [0084.676] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6cf0 [0084.676] GetProcessHeap () returned 0x590000 [0084.676] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6d00 [0084.676] GetProcessHeap () returned 0x590000 [0084.676] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6d10 [0084.676] GetProcessHeap () returned 0x590000 [0084.676] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6d20 [0084.676] GetProcessHeap () returned 0x590000 [0084.676] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6d30 [0084.676] GetProcessHeap () returned 0x590000 [0084.676] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6d40 [0084.676] GetProcessHeap () returned 0x590000 [0084.676] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6d50 [0084.676] GetProcessHeap () returned 0x590000 [0084.676] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6d60 [0084.676] GetProcessHeap () returned 0x590000 [0084.676] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6d70 [0084.677] GetProcessHeap () returned 0x590000 [0084.677] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6d80 [0084.677] GetProcessHeap () returned 0x590000 [0084.677] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6d90 [0084.678] GetProcessHeap () returned 0x590000 [0084.678] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6da0 [0084.678] GetProcessHeap () returned 0x590000 [0084.678] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6db0 [0084.678] GetProcessHeap () returned 0x590000 [0084.678] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6de0 [0084.678] GetProcessHeap () returned 0x590000 [0084.678] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6df0 [0084.678] GetProcessHeap () returned 0x590000 [0084.678] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6e00 [0084.678] GetProcessHeap () returned 0x590000 [0084.678] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6e10 [0084.678] GetProcessHeap () returned 0x590000 [0084.678] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6e20 [0084.678] GetProcessHeap () returned 0x590000 [0084.678] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6e30 [0084.678] GetProcessHeap () returned 0x590000 [0084.679] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6e40 [0084.679] GetProcessHeap () returned 0x590000 [0084.679] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6e50 [0084.679] GetProcessHeap () returned 0x590000 [0084.679] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6e60 [0084.679] GetProcessHeap () returned 0x590000 [0084.679] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6e70 [0084.679] GetProcessHeap () returned 0x590000 [0084.679] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6e80 [0084.679] GetProcessHeap () returned 0x590000 [0084.679] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6e90 [0084.679] GetProcessHeap () returned 0x590000 [0084.679] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a6ea0 [0084.679] _wcsicmp (_String1="netsh.exe", _String2="ipxmontr.dll") returned 5 [0084.679] _wcsicmp (_String1="netsh.exe", _String2="ipxpromn.dll") returned 5 [0084.679] GetProcessHeap () returned 0x590000 [0084.679] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x14) returned 0x5a71c8 [0084.679] GetProcessHeap () returned 0x590000 [0084.679] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x2) returned 0x5a6eb0 [0084.679] GetProcessHeap () returned 0x590000 [0084.679] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x14) returned 0x5a71e8 [0084.679] _wcsupr (in: _String="netsh.exe" | out: _String="NETSH.EXE") returned="NETSH.EXE" [0084.679] GetProcessHeap () returned 0x590000 [0084.680] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x590000) returned 1 [0084.680] GetProcessHeap () returned 0x590000 [0084.680] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x48) returned 0x5a7208 [0084.680] GetProcessHeap () returned 0x590000 [0084.680] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x590000) returned 1 [0084.680] GetProcessHeap () returned 0x590000 [0084.680] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x90) returned 0x5a7258 [0084.680] GetProcessHeap () returned 0x590000 [0084.680] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5a7208 | out: hHeap=0x590000) returned 1 [0084.680] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\NetSh", ulOptions=0x0, samDesired=0x20019, phkResult=0x227564 | out: phkResult=0x227564*=0xb0) returned 0x0 [0084.680] RegQueryInfoKeyW (in: hKey=0xb0, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x22755c, lpcbMaxValueNameLen=0x227550, lpcbMaxValueLen=0x227554, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x22755c*=0x12, lpcbMaxValueNameLen=0x227550, lpcbMaxValueLen=0x227554, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0084.680] GetProcessHeap () returned 0x590000 [0084.680] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x16) returned 0x5a7208 [0084.680] GetProcessHeap () returned 0x590000 [0084.680] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x23) returned 0x5a7228 [0084.680] RegEnumValueW (in: hKey=0xb0, dwIndex=0x0, lpValueName=0x5a7208, lpcchValueName=0x227548, lpReserved=0x0, lpType=0x0, lpData=0x5a7228, lpcbData=0x22754c | out: lpValueName="4", lpcchValueName=0x227548, lpType=0x0, lpData=0x5a7228, lpcbData=0x22754c) returned 0x0 [0084.680] _wcsicmp (_String1="rasmontr.dll", _String2="ipxmontr.dll") returned 9 [0084.681] _wcsicmp (_String1="rasmontr.dll", _String2="ipxpromn.dll") returned 9 [0084.681] GetProcessHeap () returned 0x590000 [0084.681] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x28) returned 0x5a72f0 [0084.681] GetProcessHeap () returned 0x590000 [0084.681] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x4) returned 0x5a6ec0 [0084.681] GetProcessHeap () returned 0x590000 [0084.681] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x1a) returned 0x5a41d0 [0084.681] _wcsupr (in: _String="rasmontr.dll" | out: _String="RASMONTR.DLL") returned="RASMONTR.DLL" [0084.681] GetProcessHeap () returned 0x590000 [0084.681] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5a71c8 | out: hHeap=0x590000) returned 1 [0084.681] LoadLibraryW (lpLibFileName="RASMONTR.DLL") Process: id = "9" image_name = "findstr.exe" filename = "c:\\windows\\syswow64\\findstr.exe" page_root = "0x1f094000" os_pid = "0xa58" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x82c" cmd_line = "findstr All" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 32 os_tid = 0x54c Process: id = "10" image_name = "tasklist.exe" filename = "c:\\windows\\syswow64\\tasklist.exe" page_root = "0x24aef000" os_pid = "0xa4c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0x92c" cmd_line = "tasklist /FO TABLE " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 31 os_tid = 0xb0 Thread: id = 38 os_tid = 0x314 Process: id = "11" image_name = "keys.util" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\keys.util" page_root = "0x266e6000" os_pid = "0xaf8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0x97c" cmd_line = "keys.util" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 33 os_tid = 0xaf4 [0085.756] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 Thread: id = 34 os_tid = 0x5e4 Thread: id = 35 os_tid = 0xa94 [0085.800] CoGetContextToken (in: pToken=0xe5fb6c | out: pToken=0xe5fb6c) returned 0x800401f0 [0085.801] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 36 os_tid = 0xa88 Process: id = "12" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x971d000" os_pid = "0x370" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "2" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000d057" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 39 os_tid = 0xa5c Thread: id = 40 os_tid = 0xa6c Thread: id = 41 os_tid = 0xa70 Thread: id = 42 os_tid = 0xb78 Thread: id = 43 os_tid = 0x3d4 Thread: id = 44 os_tid = 0x7e8 Thread: id = 45 os_tid = 0x5d8 Thread: id = 46 os_tid = 0x320 Thread: id = 47 os_tid = 0x6cc Thread: id = 48 os_tid = 0x42c Thread: id = 49 os_tid = 0x1e4 Thread: id = 50 os_tid = 0x760 Thread: id = 51 os_tid = 0x75c Thread: id = 52 os_tid = 0x74c Thread: id = 53 os_tid = 0x710 Thread: id = 54 os_tid = 0x6d0 Thread: id = 55 os_tid = 0x6bc Thread: id = 56 os_tid = 0x6b8 Thread: id = 57 os_tid = 0x6b0 Thread: id = 58 os_tid = 0x6a8 Thread: id = 59 os_tid = 0x69c Thread: id = 60 os_tid = 0x698 Thread: id = 61 os_tid = 0x684 Thread: id = 62 os_tid = 0x678 Thread: id = 63 os_tid = 0x4a8 Thread: id = 64 os_tid = 0x46c Thread: id = 65 os_tid = 0x44c Thread: id = 66 os_tid = 0x424 Thread: id = 67 os_tid = 0x420 Thread: id = 68 os_tid = 0x41c Thread: id = 69 os_tid = 0x404 Thread: id = 70 os_tid = 0x14c Thread: id = 71 os_tid = 0x158 Thread: id = 72 os_tid = 0x3fc Thread: id = 73 os_tid = 0x3f4 Thread: id = 74 os_tid = 0x3e8 Thread: id = 75 os_tid = 0x39c Thread: id = 76 os_tid = 0x390 Thread: id = 77 os_tid = 0x38c Thread: id = 78 os_tid = 0x388 Thread: id = 79 os_tid = 0x37c Thread: id = 80 os_tid = 0x374 Process: id = "13" image_name = "chrome updaters.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\chrome updaters.exe" page_root = "0x1a637000" os_pid = "0x614" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x538" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Chrome updaters.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ef13" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 81 os_tid = 0x618 [0180.183] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0182.609] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x2af114 | out: pfEnabled=0x2af114) returned 0x0 [0182.827] SleepEx (dwMilliseconds=0xad3, bAlertable=1) returned 0x0 [0188.266] SleepEx (dwMilliseconds=0x7d0, bAlertable=1) returned 0x0 [0190.413] EtwEventRegister () returned 0x0 [0190.440] GetCurrentProcess () returned 0xffffffff [0190.441] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x2ae294 | out: TokenHandle=0x2ae294*=0x214) returned 1 [0190.445] GetTokenInformation (in: TokenHandle=0x214, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x2ae294 | out: TokenInformation=0x0, ReturnLength=0x2ae294) returned 0 [0190.445] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x64d478 [0190.445] GetTokenInformation (in: TokenHandle=0x214, TokenInformationClass=0x8, TokenInformation=0x64d478, TokenInformationLength=0x4, ReturnLength=0x2ae294 | out: TokenInformation=0x64d478, ReturnLength=0x2ae294) returned 1 [0190.447] LocalFree (hMem=0x64d478) returned 0x0 [0190.447] DuplicateTokenEx (in: hExistingToken=0x214, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x2ae29c | out: phNewToken=0x2ae29c*=0x21c) returned 1 [0190.448] CheckTokenMembership (in: TokenHandle=0x21c, SidToCheck=0x2a9abd0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x2ae2ac | out: IsMember=0x2ae2ac) returned 1 [0190.448] CloseHandle (hObject=0x21c) returned 1 [0190.491] CoTaskMemAlloc (cb=0x20c) returned 0x698728 [0190.491] SHGetFolderPathW (in: hwnd=0x0, csidl=7, hToken=0x0, dwFlags=0x0, pszPath=0x698728 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x0 [0190.495] CoTaskMemFree (pv=0x698728) [0190.498] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", nBufferLength=0x105, lpBuffer=0x2ac618, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpFilePart=0x0) returned 0x5b [0190.500] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Chrome updaters.exe", nBufferLength=0x105, lpBuffer=0x2ac634, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Chrome updaters.exe", lpFilePart=0x0) returned 0x6f [0190.505] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Chrome updaters.exe", nBufferLength=0x105, lpBuffer=0x2adddc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Chrome updaters.exe", lpFilePart=0x0) returned 0x6f [0190.507] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae23c) returned 1 [0190.507] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Chrome updaters.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\chrome updaters.exe"), fInfoLevelId=0x0, lpFileInformation=0x2ae2b8 | out: lpFileInformation=0x2ae2b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebaf170, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xeebaf170, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0x9cefe300, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x223200)) returned 1 [0190.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae238) returned 1 [0190.517] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x2add78, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0190.540] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x2adc9c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0190.543] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x2add00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0190.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae160) returned 1 [0190.543] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x2ae1dc | out: lpFileInformation=0x2ae1dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0cc4300, ftCreationTime.dwHighDateTime=0x1cd5cf4, ftLastAccessTime.dwLowDateTime=0xcf7ee640, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc0cc4300, ftLastWriteTime.dwHighDateTime=0x1cd5cf4, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0190.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae15c) returned 1 [0191.651] CoTaskMemAlloc (cb=0x20c) returned 0x698728 [0191.651] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x698728 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0191.651] CoTaskMemFree (pv=0x698728) [0191.651] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x2addf8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0191.652] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x2ade0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x31 [0191.654] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Chrome updaters.exe", nBufferLength=0x105, lpBuffer=0x2add64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Chrome updaters.exe", lpFilePart=0x0) returned 0x6f [0191.662] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gpustats.bx", nBufferLength=0x105, lpBuffer=0x2adc9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gpustats.bx", lpFilePart=0x0) returned 0x3c [0191.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae190) returned 1 [0191.662] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\gpustats.bx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\gpustats.bx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x214 [0191.666] GetFileType (hFile=0x214) returned 0x1 [0191.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae18c) returned 1 [0191.666] GetFileType (hFile=0x214) returned 0x1 [0191.666] WriteFile (in: hFile=0x214, lpBuffer=0x2bbab28*, nNumberOfBytesToWrite=0x94, lpNumberOfBytesWritten=0x2ae228, lpOverlapped=0x0 | out: lpBuffer=0x2bbab28*, lpNumberOfBytesWritten=0x2ae228*=0x94, lpOverlapped=0x0) returned 1 [0191.667] CloseHandle (hObject=0x214) returned 1 [0191.718] CoTaskMemAlloc (cb=0xd) returned 0x686250 [0191.718] LoadLibraryA (lpLibFileName="kernel32") returned 0x76a20000 [0191.719] CoTaskMemFree (pv=0x686250) [0191.728] CoTaskMemAlloc (cb=0x11) returned 0x698c38 [0191.728] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ResumeThread", cchWideChar=12, lpMultiByteStr=0x2bbce2c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ResumeThread", lpUsedDefaultChar=0x0) returned 12 [0191.729] GetProcAddress (hModule=0x76a20000, lpProcName="ResumeThread") returned 0x76a343ef [0191.729] CoTaskMemFree (pv=0x698c38) [0191.735] CoTaskMemAlloc (cb=0xd) returned 0x6862b0 [0191.735] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x2bbcf34, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0191.735] LoadLibraryA (lpLibFileName="kernel32") returned 0x76a20000 [0191.735] CoTaskMemFree (pv=0x6862b0) [0191.735] CoTaskMemAlloc (cb=0x1a) returned 0x698698 [0191.735] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Wow64SetThreadContext", cchWideChar=21, lpMultiByteStr=0x2bbcf6c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Wow64SetThreadContext", lpUsedDefaultChar=0x0) returned 21 [0191.735] GetProcAddress (hModule=0x76a20000, lpProcName="Wow64SetThreadContext") returned 0x76ab5393 [0191.735] CoTaskMemFree (pv=0x698698) [0191.743] CoTaskMemAlloc (cb=0xd) returned 0x686250 [0191.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x2bbd070, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0191.743] LoadLibraryA (lpLibFileName="kernel32") returned 0x76a20000 [0191.743] CoTaskMemFree (pv=0x686250) [0191.743] CoTaskMemAlloc (cb=0x15) returned 0x698c38 [0191.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SetThreadContext", cchWideChar=16, lpMultiByteStr=0x2bbd0a8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SetThreadContext", lpUsedDefaultChar=0x0) returned 16 [0191.743] GetProcAddress (hModule=0x76a20000, lpProcName="SetThreadContext") returned 0x76ab5393 [0191.744] CoTaskMemFree (pv=0x698c38) [0191.745] CoTaskMemAlloc (cb=0xd) returned 0x686250 [0191.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x2bbd1bc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0191.745] LoadLibraryA (lpLibFileName="kernel32") returned 0x76a20000 [0191.745] CoTaskMemFree (pv=0x686250) [0191.745] CoTaskMemAlloc (cb=0x1a) returned 0x698698 [0191.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Wow64GetThreadContext", cchWideChar=21, lpMultiByteStr=0x2bbd1f4, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Wow64GetThreadContext", lpUsedDefaultChar=0x0) returned 21 [0191.745] GetProcAddress (hModule=0x76a20000, lpProcName="Wow64GetThreadContext") returned 0x76a579d4 [0191.745] CoTaskMemFree (pv=0x698698) [0191.746] CoTaskMemAlloc (cb=0xd) returned 0x686250 [0191.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x2bbd2f8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0191.746] LoadLibraryA (lpLibFileName="kernel32") returned 0x76a20000 [0191.747] CoTaskMemFree (pv=0x686250) [0191.747] CoTaskMemAlloc (cb=0x15) returned 0x698c38 [0191.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetThreadContext", cchWideChar=16, lpMultiByteStr=0x2bbd330, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetThreadContext", lpUsedDefaultChar=0x0) returned 16 [0191.747] GetProcAddress (hModule=0x76a20000, lpProcName="GetThreadContext") returned 0x76a579d4 [0191.747] CoTaskMemFree (pv=0x698c38) [0191.748] CoTaskMemAlloc (cb=0xd) returned 0x686250 [0191.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x2bbd420, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0191.748] LoadLibraryA (lpLibFileName="kernel32") returned 0x76a20000 [0191.748] CoTaskMemFree (pv=0x686250) [0191.748] CoTaskMemAlloc (cb=0x13) returned 0x698c78 [0191.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VirtualAllocEx", cchWideChar=14, lpMultiByteStr=0x2bbd458, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VirtualAllocEx", lpUsedDefaultChar=0x0) returned 14 [0191.748] GetProcAddress (hModule=0x76a20000, lpProcName="VirtualAllocEx") returned 0x76a4d9b0 [0191.749] CoTaskMemFree (pv=0x698c78) [0191.753] CoTaskMemAlloc (cb=0xd) returned 0x6862b0 [0191.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x2bbd554, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0191.753] LoadLibraryA (lpLibFileName="kernel32") returned 0x76a20000 [0191.753] CoTaskMemFree (pv=0x6862b0) [0191.753] CoTaskMemAlloc (cb=0x17) returned 0x698c38 [0191.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WriteProcessMemory", cchWideChar=18, lpMultiByteStr=0x2bbd58c, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WriteProcessMemory", lpUsedDefaultChar=0x0) returned 18 [0191.754] GetProcAddress (hModule=0x76a20000, lpProcName="WriteProcessMemory") returned 0x76a4d9e0 [0191.754] CoTaskMemFree (pv=0x698c38) [0191.757] CoTaskMemAlloc (cb=0xd) returned 0x686250 [0191.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x2bbd690, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0191.757] LoadLibraryA (lpLibFileName="kernel32") returned 0x76a20000 [0191.757] CoTaskMemFree (pv=0x686250) [0191.757] CoTaskMemAlloc (cb=0x16) returned 0x698c78 [0191.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ReadProcessMemory", cchWideChar=17, lpMultiByteStr=0x2bbd6c8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadProcessMemory", lpUsedDefaultChar=0x0) returned 17 [0191.758] GetProcAddress (hModule=0x76a20000, lpProcName="ReadProcessMemory") returned 0x76a4cfcc [0191.758] CoTaskMemFree (pv=0x698c78) [0191.760] CoTaskMemAlloc (cb=0xa) returned 0x6862b0 [0191.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ntdll", cchWideChar=5, lpMultiByteStr=0x2bbd828, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ntdll", lpUsedDefaultChar=0x0) returned 5 [0191.760] LoadLibraryA (lpLibFileName="ntdll") returned 0x77070000 [0191.760] CoTaskMemFree (pv=0x6862b0) [0191.761] CoTaskMemAlloc (cb=0x19) returned 0x698698 [0191.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ZwUnmapViewOfSection", cchWideChar=20, lpMultiByteStr=0x2bbd854, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ZwUnmapViewOfSection", lpUsedDefaultChar=0x0) returned 20 [0191.761] GetProcAddress (hModule=0x77070000, lpProcName="ZwUnmapViewOfSection") returned 0x7708fc70 [0191.761] CoTaskMemFree (pv=0x698698) [0191.763] CoTaskMemAlloc (cb=0xd) returned 0x6862b0 [0191.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x2bbd950, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0191.763] LoadLibraryA (lpLibFileName="kernel32") returned 0x76a20000 [0191.763] CoTaskMemFree (pv=0x6862b0) [0191.763] CoTaskMemAlloc (cb=0x13) returned 0x698c78 [0191.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateProcessA", cchWideChar=14, lpMultiByteStr=0x2bbd988, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateProcessA", lpUsedDefaultChar=0x0) returned 14 [0191.764] GetProcAddress (hModule=0x76a20000, lpProcName="CreateProcessA") returned 0x76a31072 [0191.764] CoTaskMemFree (pv=0x698c78) [0191.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe", cchWideChar=57, lpMultiByteStr=0x2ae140, cbMultiByte=59, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe±V", lpUsedDefaultChar=0x0) returned 57 [0191.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=0, lpMultiByteStr=0x2ae13c, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="@á*", lpUsedDefaultChar=0x0) returned 0 [0191.784] CreateProcessA (in: lpApplicationName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe", lpCommandLine="", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000004, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x2ae1b0*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2ae2dc | out: lpCommandLine="", lpProcessInformation=0x2ae2dc*(hProcess=0x244, hThread=0x214, dwProcessId=0x460, dwThreadId=0x444)) returned 1 [0191.809] CoTaskMemFree (pv=0x0) [0191.809] GetThreadContext (in: hThread=0x214, lpContext=0x2bbda20 | out: lpContext=0x2bbda20*(ContextFlags=0x10002, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0xfffde000, Edx=0x0, Ecx=0x0, Eax=0xcb975e, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0191.809] ReadProcessMemory (in: hProcess=0x244, lpBaseAddress=0xfffde008, lpBuffer=0x2ae2c8, nSize=0x4, lpNumberOfBytesRead=0x2ae2b8 | out: lpBuffer=0x2ae2c8*, lpNumberOfBytesRead=0x2ae2b8*=0x4) returned 1 [0191.809] VirtualAllocEx (hProcess=0x244, lpAddress=0x400000, dwSize=0xd8000, flAllocationType=0x3000, flProtect=0x40) returned 0x400000 [0191.813] WriteProcessMemory (in: hProcess=0x244, lpBaseAddress=0x400000, lpBuffer=0x57752d8*, nSize=0x200, lpNumberOfBytesWritten=0x2ae2b8 | out: lpBuffer=0x57752d8*, lpNumberOfBytesWritten=0x2ae2b8*=0x200) returned 1 [0191.832] WriteProcessMemory (in: hProcess=0x244, lpBaseAddress=0x402000, lpBuffer=0x58468f8*, nSize=0xd0a00, lpNumberOfBytesWritten=0x2ae2b8 | out: lpBuffer=0x58468f8*, lpNumberOfBytesWritten=0x2ae2b8*=0xd0a00) returned 1 [0191.859] WriteProcessMemory (in: hProcess=0x244, lpBaseAddress=0x4d4000, lpBuffer=0x2bbdcf8*, nSize=0x800, lpNumberOfBytesWritten=0x2ae2b8 | out: lpBuffer=0x2bbdcf8*, lpNumberOfBytesWritten=0x2ae2b8*=0x800) returned 1 [0191.872] WriteProcessMemory (in: hProcess=0x244, lpBaseAddress=0x4d6000, lpBuffer=0x2bbe504*, nSize=0x200, lpNumberOfBytesWritten=0x2ae2b8 | out: lpBuffer=0x2bbe504*, lpNumberOfBytesWritten=0x2ae2b8*=0x200) returned 1 [0191.884] WriteProcessMemory (in: hProcess=0x244, lpBaseAddress=0xfffde008, lpBuffer=0x2bbe710*, nSize=0x4, lpNumberOfBytesWritten=0x2ae2b8 | out: lpBuffer=0x2bbe710*, lpNumberOfBytesWritten=0x2ae2b8*=0x4) returned 1 [0191.885] SetThreadContext (hThread=0x214, lpContext=0x2bbda20*(ContextFlags=0x10002, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0xfffde000, Edx=0x0, Ecx=0x0, Eax=0x4d295e, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0191.885] ResumeThread (hThread=0x214) returned 0x1 [0191.979] CoTaskMemAlloc (cb=0x20c) returned 0x698728 [0191.979] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x698728 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x0 [0191.979] CoTaskMemFree (pv=0x698728) [0191.979] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x2add68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpFilePart=0x0) returned 0x2d [0192.038] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\_CL_02f3a8c9sy", nBufferLength=0x105, lpBuffer=0x2adc9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\_CL_02f3a8c9sy", lpFilePart=0x0) returned 0x46 [0192.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae190) returned 1 [0192.039] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\_CL_02f3a8c9sy" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\_cl_02f3a8c9sy"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x248 [0192.039] GetFileType (hFile=0x248) returned 0x1 [0192.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae18c) returned 1 [0192.039] GetFileType (hFile=0x248) returned 0x1 [0192.039] WriteFile (in: hFile=0x248, lpBuffer=0x2bed210*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2ae228, lpOverlapped=0x0 | out: lpBuffer=0x2bed210*, lpNumberOfBytesWritten=0x2ae228*=0x30, lpOverlapped=0x0) returned 1 [0192.040] CloseHandle (hObject=0x248) returned 1 [0192.055] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe", nBufferLength=0x105, lpBuffer=0x2adcd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe", lpFilePart=0x0) returned 0x42 [0192.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1c8) returned 1 [0192.055] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ctfmom.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x248 [0192.072] GetFileType (hFile=0x248) returned 0x1 [0192.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae1c4) returned 1 [0192.072] GetFileType (hFile=0x248) returned 0x1 [0192.072] WriteFile (in: hFile=0x248, lpBuffer=0x5917318*, nNumberOfBytesToWrite=0x3b800, lpNumberOfBytesWritten=0x2ae284, lpOverlapped=0x0 | out: lpBuffer=0x5917318*, lpNumberOfBytesWritten=0x2ae284*=0x3b800, lpOverlapped=0x0) returned 1 [0192.077] CloseHandle (hObject=0x248) returned 1 [0192.080] SleepEx (dwMilliseconds=0x3e8, bAlertable=1) returned 0x0 [0193.119] SleepEx (dwMilliseconds=0xbb8, bAlertable=1) returned 0x0 [0196.226] ShellExecuteExW (in: pExecInfo=0x2bf0640*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x2bf0640*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x3a4)) returned 1 [0197.446] LocalFree (hMem=0x65dbd0) returned 0x0 [0197.539] GetFullPathNameW (in: lpFileName="keys.util", nBufferLength=0x105, lpBuffer=0x2adcd4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\keys.util", lpFilePart=0x0) returned 0x1d [0197.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae1c8) returned 1 [0197.539] CreateFileW (lpFileName="C:\\Windows\\system32\\keys.util" (normalized: "c:\\windows\\system32\\keys.util"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0197.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2acc48) returned 1 [0199.680] LocalAlloc (uFlags=0x0, uBytes=0x10) returned 0x6bd258 [0199.680] LocalAlloc (uFlags=0x0, uBytes=0x1a) returned 0x6c0098 [0199.681] ShellExecuteExW (in: pExecInfo=0x2a36224*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="cmd.exe", lpParameters="/c keys.util", lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x2a36224*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="cmd.exe", lpParameters="/c keys.util", lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x3dc)) returned 1 [0199.833] LocalFree (hMem=0x6bd258) returned 0x0 [0199.833] LocalFree (hMem=0x6c0098) returned 0x0 [0199.834] CoTaskMemAlloc (cb=0x20c) returned 0x6c6320 [0199.834] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x6c6320 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0199.834] CoTaskMemFree (pv=0x6c6320) [0199.834] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x2adce8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0199.834] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x2adcfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x31 [0199.836] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ran.bx", nBufferLength=0x105, lpBuffer=0x2adb8c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ran.bx", lpFilePart=0x0) returned 0x37 [0199.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ae080) returned 1 [0199.836] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ran.bx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ran.bx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3cc [0199.869] GetFileType (hFile=0x3cc) returned 0x1 [0199.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ae07c) returned 1 [0199.869] GetFileType (hFile=0x3cc) returned 0x1 [0199.869] WriteFile (in: hFile=0x3cc, lpBuffer=0x2a386ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ae118, lpOverlapped=0x0 | out: lpBuffer=0x2a386ac*, lpNumberOfBytesWritten=0x2ae118*=0x4, lpOverlapped=0x0) returned 1 [0199.870] CloseHandle (hObject=0x3cc) returned 1 [0199.878] CoGetContextToken (in: pToken=0x2aeb30 | out: pToken=0x2aeb30) returned 0x0 [0199.878] CObjectContext::QueryInterface () returned 0x0 [0199.878] CObjectContext::GetCurrentThreadType () returned 0x0 [0199.878] Release () returned 0x0 [0199.886] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x13880, cHandles=0x1, pHandles=0x605048*=0xa8, lpdwindex=0x2ae9d4 | out: lpdwindex=0x2ae9d4) returned 0x0 Thread: id = 82 os_tid = 0x59c Thread: id = 83 os_tid = 0x5ac [0180.389] CoGetContextToken (in: pToken=0x10afb1c | out: pToken=0x10afb1c) returned 0x800401f0 [0180.406] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0191.037] CloseHandle (hObject=0x214) returned 1 [0197.518] CloseHandle (hObject=0x3a4) returned 1 [0200.019] EtwEventUnregister () returned 0x0 [0200.021] CloseHandle (hObject=0x3dc) returned 1 [0200.023] SleepEx (dwMilliseconds=0xffffffff, bAlertable=0) Thread: id = 84 os_tid = 0x5e4 Thread: id = 85 os_tid = 0x65c Thread: id = 104 os_tid = 0x33c Thread: id = 105 os_tid = 0x734 Thread: id = 109 os_tid = 0x778 [0200.024] SleepEx (dwMilliseconds=0x14, bAlertable=0) returned 0x0 [0200.154] SleepEx (dwMilliseconds=0x14, bAlertable=0) Thread: id = 111 os_tid = 0x6e8 Process: id = "14" image_name = "msbuild.exe" filename = "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\msbuild.exe" page_root = "0xe375000" os_pid = "0x460" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "13" os_parent_pid = "0x614" cmd_line = "\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ef13" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 86 os_tid = 0x444 [0192.432] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0192.566] CoTaskMemAlloc (cb=0x20c) returned 0x997100 [0192.566] SHGetFolderPathW (in: hwnd=0x0, csidl=0, hToken=0x0, dwFlags=0x0, pszPath=0x997100 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x0 [0192.569] CoTaskMemFree (pv=0x997100) [0192.572] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x32d424, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0192.575] CoTaskMemAlloc (cb=0x20c) returned 0x997100 [0192.575] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x997100 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned 0x0 [0192.576] CoTaskMemFree (pv=0x997100) [0192.576] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x32d424, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", lpFilePart=0x0) returned 0x2b [0192.576] CoTaskMemAlloc (cb=0x20c) returned 0x997100 [0192.576] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x997100 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0192.577] CoTaskMemFree (pv=0x997100) [0192.577] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x32d424, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0192.577] CoTaskMemAlloc (cb=0x20c) returned 0x997100 [0192.577] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x997100 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x0 [0192.578] CoTaskMemFree (pv=0x997100) [0192.579] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x32d424, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpFilePart=0x0) returned 0x2d [0192.579] CoTaskMemAlloc (cb=0x20c) returned 0x997100 [0192.579] SHGetFolderPathW (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x997100 | out: pszPath="C:\\ProgramData") returned 0x0 [0192.581] CoTaskMemFree (pv=0x997100) [0192.581] GetFullPathNameW (in: lpFileName="C:\\ProgramData", nBufferLength=0x105, lpBuffer=0x32d424, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData", lpFilePart=0x0) returned 0xe [0192.581] CoTaskMemAlloc (cb=0x20c) returned 0x997100 [0192.581] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x997100 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned 0x0 [0192.582] CoTaskMemFree (pv=0x997100) [0192.582] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", nBufferLength=0x105, lpBuffer=0x32d424, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", lpFilePart=0x0) returned 0x27 [0192.582] CoTaskMemAlloc (cb=0x20c) returned 0x997100 [0192.582] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x997100 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0192.583] CoTaskMemFree (pv=0x997100) [0192.583] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", nBufferLength=0x105, lpBuffer=0x32d424, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d [0192.585] GetTimeZoneInformation (in: lpTimeZoneInformation=0x32d7dc | out: lpTimeZoneInformation=0x32d7dc) returned 0x2 [0192.589] GetDynamicTimeZoneInformation (in: pTimeZoneInformation=0x32d630 | out: pTimeZoneInformation=0x32d630) returned 0x2 [0192.599] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\AUS Eastern Standard Time", ulOptions=0x0, samDesired=0x20019, phkResult=0x32d714 | out: phkResult=0x32d714*=0x200) returned 0x0 [0192.600] RegQueryValueExW (in: hKey=0x200, lpValueName="TZI", lpReserved=0x0, lpType=0x32d730, lpData=0x0, lpcbData=0x32d72c*=0x0 | out: lpType=0x32d730*=0x3, lpData=0x0, lpcbData=0x32d72c*=0x2c) returned 0x0 [0192.600] RegQueryValueExW (in: hKey=0x200, lpValueName="TZI", lpReserved=0x0, lpType=0x32d730, lpData=0x242877c, lpcbData=0x32d72c*=0x2c | out: lpType=0x32d730*=0x3, lpData=0x242877c*, lpcbData=0x32d72c*=0x2c) returned 0x0 [0192.600] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\AUS Eastern Standard Time\\Dynamic DST", ulOptions=0x0, samDesired=0x20019, phkResult=0x32d568 | out: phkResult=0x32d568*=0x204) returned 0x0 [0192.601] RegQueryValueExW (in: hKey=0x204, lpValueName="FirstEntry", lpReserved=0x0, lpType=0x32d584, lpData=0x0, lpcbData=0x32d580*=0x0 | out: lpType=0x32d584*=0x4, lpData=0x0, lpcbData=0x32d580*=0x4) returned 0x0 [0192.601] RegQueryValueExW (in: hKey=0x204, lpValueName="FirstEntry", lpReserved=0x0, lpType=0x32d584, lpData=0x32d570, lpcbData=0x32d580*=0x4 | out: lpType=0x32d584*=0x4, lpData=0x32d570*=0x7d7, lpcbData=0x32d580*=0x4) returned 0x0 [0192.601] RegQueryValueExW (in: hKey=0x204, lpValueName="LastEntry", lpReserved=0x0, lpType=0x32d584, lpData=0x0, lpcbData=0x32d580*=0x0 | out: lpType=0x32d584*=0x4, lpData=0x0, lpcbData=0x32d580*=0x4) returned 0x0 [0192.601] RegQueryValueExW (in: hKey=0x204, lpValueName="LastEntry", lpReserved=0x0, lpType=0x32d584, lpData=0x32d570, lpcbData=0x32d580*=0x4 | out: lpType=0x32d584*=0x4, lpData=0x32d570*=0x7d8, lpcbData=0x32d580*=0x4) returned 0x0 [0192.601] RegQueryValueExW (in: hKey=0x204, lpValueName="2007", lpReserved=0x0, lpType=0x32d584, lpData=0x0, lpcbData=0x32d580*=0x0 | out: lpType=0x32d584*=0x3, lpData=0x0, lpcbData=0x32d580*=0x2c) returned 0x0 [0192.601] RegQueryValueExW (in: hKey=0x204, lpValueName="2007", lpReserved=0x0, lpType=0x32d584, lpData=0x2428de0, lpcbData=0x32d580*=0x2c | out: lpType=0x32d584*=0x3, lpData=0x2428de0*, lpcbData=0x32d580*=0x2c) returned 0x0 [0192.601] RegQueryValueExW (in: hKey=0x204, lpValueName="2008", lpReserved=0x0, lpType=0x32d584, lpData=0x0, lpcbData=0x32d580*=0x0 | out: lpType=0x32d584*=0x3, lpData=0x0, lpcbData=0x32d580*=0x2c) returned 0x0 [0192.601] RegQueryValueExW (in: hKey=0x204, lpValueName="2008", lpReserved=0x0, lpType=0x32d584, lpData=0x2428ea0, lpcbData=0x32d580*=0x2c | out: lpType=0x32d584*=0x3, lpData=0x2428ea0*, lpcbData=0x32d580*=0x2c) returned 0x0 [0192.602] RegCloseKey (hKey=0x204) returned 0x0 [0192.602] RegQueryValueExW (in: hKey=0x200, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x32d708, lpData=0x0, lpcbData=0x32d704*=0x0 | out: lpType=0x32d708*=0x1, lpData=0x0, lpcbData=0x32d704*=0x20) returned 0x0 [0192.602] RegQueryValueExW (in: hKey=0x200, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x32d708, lpData=0x2428fe8, lpcbData=0x32d704*=0x20 | out: lpType=0x32d708*=0x1, lpData="@tzres.dll,-670", lpcbData=0x32d704*=0x20) returned 0x0 [0192.603] RegQueryValueExW (in: hKey=0x200, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x32d708, lpData=0x0, lpcbData=0x32d704*=0x0 | out: lpType=0x32d708*=0x1, lpData=0x0, lpcbData=0x32d704*=0x20) returned 0x0 [0192.603] RegQueryValueExW (in: hKey=0x200, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x32d708, lpData=0x2429040, lpcbData=0x32d704*=0x20 | out: lpType=0x32d708*=0x1, lpData="@tzres.dll,-672", lpcbData=0x32d704*=0x20) returned 0x0 [0192.603] RegQueryValueExW (in: hKey=0x200, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x32d708, lpData=0x0, lpcbData=0x32d704*=0x0 | out: lpType=0x32d708*=0x1, lpData=0x0, lpcbData=0x32d704*=0x20) returned 0x0 [0192.603] RegQueryValueExW (in: hKey=0x200, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x32d708, lpData=0x2429098, lpcbData=0x32d704*=0x20 | out: lpType=0x32d708*=0x1, lpData="@tzres.dll,-671", lpcbData=0x32d704*=0x20) returned 0x0 [0192.604] CoTaskMemAlloc (cb=0x20c) returned 0x99bbc8 [0192.604] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x99bbc8 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0192.604] CoTaskMemFree (pv=0x99bbc8) [0192.605] CoTaskMemAlloc (cb=0x20c) returned 0x99bbc8 [0192.605] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x32d724, pwszFileMUIPath=0x99bbc8, pcchFileMUIPath=0x32d728, pululEnumerator=0x32d71c | out: pwszLanguage=0x0, pcchLanguage=0x32d724, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x32d728, pululEnumerator=0x32d71c) returned 1 [0192.621] CoTaskMemFree (pv=0x0) [0192.621] CoTaskMemFree (pv=0x99bbc8) [0192.622] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x3e0001 [0192.624] CoTaskMemAlloc (cb=0x3ec) returned 0x99bbc8 [0192.624] LoadStringW (in: hInstance=0x3e0001, uID=0x29e, lpBuffer=0x99bbc8, cchBufferMax=500 | out: lpBuffer="(UTC+10:00) Canberra, Melbourne, Sydney") returned 0x27 [0192.624] CoTaskMemFree (pv=0x99bbc8) [0192.624] FreeLibrary (hLibModule=0x3e0001) returned 1 [0192.625] CoTaskMemAlloc (cb=0x20c) returned 0x99bbc8 [0192.625] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x99bbc8 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0192.625] CoTaskMemFree (pv=0x99bbc8) [0192.625] CoTaskMemAlloc (cb=0x20c) returned 0x99bbc8 [0192.625] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x32d724, pwszFileMUIPath=0x99bbc8, pcchFileMUIPath=0x32d728, pululEnumerator=0x32d71c | out: pwszLanguage=0x0, pcchLanguage=0x32d724, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x32d728, pululEnumerator=0x32d71c) returned 1 [0192.625] CoTaskMemFree (pv=0x0) [0192.625] CoTaskMemFree (pv=0x99bbc8) [0192.625] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x3e0001 [0192.626] CoTaskMemAlloc (cb=0x3ec) returned 0x99bbc8 [0192.626] LoadStringW (in: hInstance=0x3e0001, uID=0x2a0, lpBuffer=0x99bbc8, cchBufferMax=500 | out: lpBuffer="AUS Eastern Standard Time") returned 0x19 [0192.626] CoTaskMemFree (pv=0x99bbc8) [0192.626] FreeLibrary (hLibModule=0x3e0001) returned 1 [0192.626] CoTaskMemAlloc (cb=0x20c) returned 0x99bbc8 [0192.627] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x99bbc8 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0192.627] CoTaskMemFree (pv=0x99bbc8) [0192.627] CoTaskMemAlloc (cb=0x20c) returned 0x99bbc8 [0192.627] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x32d724, pwszFileMUIPath=0x99bbc8, pcchFileMUIPath=0x32d728, pululEnumerator=0x32d71c | out: pwszLanguage=0x0, pcchLanguage=0x32d724, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x32d728, pululEnumerator=0x32d71c) returned 1 [0192.627] CoTaskMemFree (pv=0x0) [0192.627] CoTaskMemFree (pv=0x99bbc8) [0192.627] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x3e0001 [0192.628] CoTaskMemAlloc (cb=0x3ec) returned 0x99bbc8 [0192.628] LoadStringW (in: hInstance=0x3e0001, uID=0x29f, lpBuffer=0x99bbc8, cchBufferMax=500 | out: lpBuffer="AUS Eastern Daylight Time") returned 0x19 [0192.628] CoTaskMemFree (pv=0x99bbc8) [0192.628] FreeLibrary (hLibModule=0x3e0001) returned 1 [0192.629] RegCloseKey (hKey=0x200) returned 0x0 [0192.724] CoTaskMemAlloc (cb=0x20c) returned 0x9a13c8 [0192.724] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x9a13c8 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0192.724] CoTaskMemFree (pv=0x9a13c8) [0192.725] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x32d4b4, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0192.725] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x32d4c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x31 [0192.726] CoTaskMemAlloc (cb=0x20c) returned 0x9a13c8 [0192.726] GetEnvironmentVariableW (in: lpName="Temp", lpBuffer=0x9a13c8, nSize=0x104 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x24 [0192.726] CoTaskMemFree (pv=0x9a13c8) [0192.726] GetUserNameW (in: lpBuffer=0x32d760, pcbBuffer=0x32d9d8 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x32d9d8) returned 1 [0192.756] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x32d340, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0192.756] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x32d3a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0192.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x32d804) returned 1 [0192.757] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x32d880 | out: lpFileInformation=0x32d880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0cc4300, ftCreationTime.dwHighDateTime=0x1cd5cf4, ftLastAccessTime.dwLowDateTime=0xcf7ee640, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc0cc4300, ftLastWriteTime.dwHighDateTime=0x1cd5cf4, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0192.757] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x32d800) returned 1 [0192.811] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x32d58c | out: pfEnabled=0x32d58c) returned 0x0 [0192.832] GetComputerNameW (in: lpBuffer=0x32d760, nSize=0x32d9d8 | out: lpBuffer="XDUWTFONO", nSize=0x32d9d8) returned 1 [0192.833] GetComputerNameW (in: lpBuffer=0x32d760, nSize=0x32d9d8 | out: lpBuffer="XDUWTFONO", nSize=0x32d9d8) returned 1 [0192.833] CoTaskMemAlloc (cb=0x20c) returned 0x9a50c0 [0192.833] GetEnvironmentVariableW (in: lpName="Temp", lpBuffer=0x9a50c0, nSize=0x104 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x24 [0192.834] CoTaskMemFree (pv=0x9a50c0) [0192.834] GetUserNameW (in: lpBuffer=0x32d760, pcbBuffer=0x32d9d8 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x32d9d8) returned 1 [0192.834] GetComputerNameW (in: lpBuffer=0x32d760, nSize=0x32d9d8 | out: lpBuffer="XDUWTFONO", nSize=0x32d9d8) returned 1 [0192.835] CoTaskMemAlloc (cb=0x20c) returned 0x9a5230 [0192.835] GetEnvironmentVariableW (in: lpName="windir", lpBuffer=0x9a5230, nSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0192.836] CoTaskMemFree (pv=0x9a5230) [0192.836] CoTaskMemAlloc (cb=0x20c) returned 0x9a5230 [0192.836] GetEnvironmentVariableW (in: lpName="windir", lpBuffer=0x9a5230, nSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0192.836] CoTaskMemFree (pv=0x9a5230) [0192.891] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe", nBufferLength=0x105, lpBuffer=0x32ebd4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe", lpFilePart=0x0) returned 0x39 [0192.891] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe", nBufferLength=0x105, lpBuffer=0x32eb4c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe", lpFilePart=0x0) returned 0x39 [0192.900] VirtualProtect (in: lpAddress=0x4d294e, dwSize=0xb, flNewProtect=0x40, lpflOldProtect=0x32f170 | out: lpflOldProtect=0x32f170*=0x40) returned 1 [0192.914] VirtualProtect (in: lpAddress=0x4d2942, dwSize=0xb, flNewProtect=0x40, lpflOldProtect=0x32f170 | out: lpflOldProtect=0x32f170*=0x40) returned 1 [0192.927] VirtualProtect (in: lpAddress=0x400178, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x32f170 | out: lpflOldProtect=0x32f170*=0x40) returned 1 [0192.941] VirtualProtect (in: lpAddress=0x4001a0, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x32f170 | out: lpflOldProtect=0x32f170*=0x40) returned 1 [0192.954] VirtualProtect (in: lpAddress=0x4001c8, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x32f170 | out: lpflOldProtect=0x32f170*=0x40) returned 1 [0192.968] VirtualProtect (in: lpAddress=0x402008, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x32f170 | out: lpflOldProtect=0x32f170*=0x40) returned 1 [0192.980] VirtualProtect (in: lpAddress=0x4188f8, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x32f170 | out: lpflOldProtect=0x32f170*=0x40) returned 1 [0193.007] VirtualProtect (in: lpAddress=0x418918, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x32f170 | out: lpflOldProtect=0x32f170*=0x40) returned 1 [0193.020] VirtualProtect (in: lpAddress=0x418920, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x32f170 | out: lpflOldProtect=0x32f170*=0x40) returned 1 [0193.032] VirtualProtect (in: lpAddress=0x418924, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x32f170 | out: lpflOldProtect=0x32f170*=0x40) returned 1 [0193.046] VirtualProtect (in: lpAddress=0x41892c, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x32f170 | out: lpflOldProtect=0x32f170*=0x40) returned 1 [0193.058] VirtualProtect (in: lpAddress=0x418930, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x32f170 | out: lpflOldProtect=0x32f170*=0x40) returned 1 [0193.071] VirtualProtect (in: lpAddress=0x418934, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x32f170 | out: lpflOldProtect=0x32f170*=0x40) returned 1 [0193.084] VirtualProtect (in: lpAddress=0x418938, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x32f170 | out: lpflOldProtect=0x32f170*=0x40) returned 1 [0193.095] VirtualProtect (in: lpAddress=0x418940, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x32f170 | out: lpflOldProtect=0x32f170*=0x40) returned 1 [0193.107] VirtualProtect (in: lpAddress=0x418944, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x32f170 | out: lpflOldProtect=0x32f170*=0x40) returned 1 [0193.120] VirtualProtect (in: lpAddress=0x41894c, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x32f170 | out: lpflOldProtect=0x32f170*=0x40) returned 1 [0193.131] VirtualProtect (in: lpAddress=0x418950, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x32f170 | out: lpflOldProtect=0x32f170*=0x40) returned 1 [0193.155] VirtualProtect (in: lpAddress=0x418954, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x32f170 | out: lpflOldProtect=0x32f170*=0x40) returned 1 [0193.168] VirtualProtect (in: lpAddress=0x41895c, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x32f170 | out: lpflOldProtect=0x32f170*=0x40) returned 1 [0193.179] VirtualProtect (in: lpAddress=0x418960, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x32f170 | out: lpflOldProtect=0x32f170*=0x40) returned 1 [0193.212] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x32dba8 | out: phkResult=0x32dba8*=0x0) returned 0x2 [0193.224] EtwEventRegister () returned 0x0 [0193.244] EtwEventRegister () returned 0x0 Thread: id = 87 os_tid = 0x458 Thread: id = 88 os_tid = 0x45c [0192.456] CoGetContextToken (in: pToken=0x452f4fc | out: pToken=0x452f4fc) returned 0x0 [0192.456] CObjectContext::QueryInterface () returned 0x0 [0192.456] CObjectContext::GetCurrentThreadType () returned 0x0 [0192.456] Release () returned 0x0 [0192.456] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0205.516] GdipDeleteGraphics (graphics=0x2132730) returned 0x0 [0205.516] GdipDisposeImage (image=0x2132230) returned 0x0 [0205.564] CloseHandle (hObject=0x4d4) returned 1 [0205.564] RegCloseKey (hKey=0x48c) returned 0x0 [0205.564] CloseHandle (hObject=0x328) returned 1 [0205.565] RegCloseKey (hKey=0x358) returned 0x0 [0205.565] RegCloseKey (hKey=0x354) returned 0x0 [0205.565] RegCloseKey (hKey=0x350) returned 0x0 [0205.565] RegCloseKey (hKey=0x34c) returned 0x0 [0205.565] RegCloseKey (hKey=0x348) returned 0x0 [0205.565] RegCloseKey (hKey=0x344) returned 0x0 [0205.565] RegCloseKey (hKey=0x340) returned 0x0 [0205.565] RegCloseKey (hKey=0x33c) returned 0x0 [0205.565] RegCloseKey (hKey=0x338) returned 0x0 [0205.565] RegCloseKey (hKey=0x334) returned 0x0 [0205.566] RegCloseKey (hKey=0x330) returned 0x0 [0205.566] RegCloseKey (hKey=0x32c) returned 0x0 [0205.566] RegCloseKey (hKey=0x47c) returned 0x0 [0205.566] RegCloseKey (hKey=0x324) returned 0x0 [0205.566] RegCloseKey (hKey=0x320) returned 0x0 [0205.566] RegCloseKey (hKey=0x31c) returned 0x0 [0205.566] RegCloseKey (hKey=0x318) returned 0x0 [0205.566] RegCloseKey (hKey=0x314) returned 0x0 [0205.566] RegCloseKey (hKey=0x310) returned 0x0 [0205.567] RegCloseKey (hKey=0x30c) returned 0x0 [0205.567] RegCloseKey (hKey=0x308) returned 0x0 [0205.567] RegCloseKey (hKey=0x304) returned 0x0 [0205.567] RegCloseKey (hKey=0x300) returned 0x0 [0205.567] RegCloseKey (hKey=0x2fc) returned 0x0 [0205.567] RegCloseKey (hKey=0x2f8) returned 0x0 [0205.567] RegCloseKey (hKey=0x2f4) returned 0x0 [0205.567] RegCloseKey (hKey=0x2f0) returned 0x0 [0205.567] RegCloseKey (hKey=0x2ec) returned 0x0 [0205.567] RegCloseKey (hKey=0x2e8) returned 0x0 [0205.568] RegCloseKey (hKey=0x2e4) returned 0x0 [0205.568] RegCloseKey (hKey=0x2e0) returned 0x0 [0205.568] RegCloseKey (hKey=0x2dc) returned 0x0 [0205.568] RegCloseKey (hKey=0x2d8) returned 0x0 [0205.568] RegCloseKey (hKey=0x2d4) returned 0x0 [0205.568] RegCloseKey (hKey=0x2d0) returned 0x0 [0205.568] RegCloseKey (hKey=0x2cc) returned 0x0 [0205.568] RegCloseKey (hKey=0x2c8) returned 0x0 [0205.568] RegCloseKey (hKey=0x2c4) returned 0x0 [0205.568] RegCloseKey (hKey=0x2c0) returned 0x0 [0205.568] RegCloseKey (hKey=0x2bc) returned 0x0 [0205.569] RegCloseKey (hKey=0x2b8) returned 0x0 [0205.569] RegCloseKey (hKey=0x2b4) returned 0x0 [0205.569] RegCloseKey (hKey=0x2b0) returned 0x0 [0205.569] RegCloseKey (hKey=0x2ac) returned 0x0 [0205.569] RegCloseKey (hKey=0x2a8) returned 0x0 [0205.569] RegCloseKey (hKey=0x2a4) returned 0x0 [0205.569] RegCloseKey (hKey=0x2a0) returned 0x0 [0205.569] RegCloseKey (hKey=0x29c) returned 0x0 [0205.569] RegCloseKey (hKey=0x294) returned 0x0 [0205.570] RegCloseKey (hKey=0x298) returned 0x0 [0205.570] RegCloseKey (hKey=0x4b0) returned 0x0 [0219.122] CoGetContextToken (in: pToken=0x452f4f0 | out: pToken=0x452f4f0) returned 0x0 [0219.122] CoGetContextToken (in: pToken=0x452f478 | out: pToken=0x452f478) returned 0x0 [0219.122] WbemLocator:IUnknown:Release (This=0x9fa3bc) returned 0x1 [0219.122] WbemLocator:IUnknown:Release (This=0x5fed544) returned 0x0 [0219.143] CoGetContextToken (in: pToken=0x452f478 | out: pToken=0x452f478) returned 0x0 [0219.143] WbemLocator:IUnknown:Release (This=0x5fe0d60) returned 0x1 [0219.143] WbemLocator:IUnknown:Release (This=0x5fe0d60) returned 0x0 [0219.143] CoGetContextToken (in: pToken=0x452f478 | out: pToken=0x452f478) returned 0x0 [0219.143] WbemLocator:IUnknown:Release (This=0x5fef6d8) returned 0x1 [0219.143] WbemLocator:IUnknown:Release (This=0x5fef6d8) returned 0x0 [0219.143] CoGetContextToken (in: pToken=0x452f478 | out: pToken=0x452f478) returned 0x0 [0219.143] WbemLocator:IUnknown:Release (This=0x5fef6e8) returned 0x1 [0219.143] WbemLocator:IUnknown:Release (This=0x5fef6e8) returned 0x0 [0219.143] CoGetContextToken (in: pToken=0x452f478 | out: pToken=0x452f478) returned 0x0 [0219.143] IUnknown:Release (This=0x5ff2a50) returned 0x2 [0219.143] IUnknown:Release (This=0x5ff2a50) returned 0x1 [0219.143] CoGetContextToken (in: pToken=0x452f478 | out: pToken=0x452f478) returned 0x0 [0219.143] WbemLocator:IUnknown:Release (This=0x5fef7a0) returned 0x1 [0219.143] WbemLocator:IUnknown:Release (This=0x5fef7a0) returned 0x0 [0219.144] CoGetContextToken (in: pToken=0x452f478 | out: pToken=0x452f478) returned 0x0 [0219.144] IUnknown:Release (This=0x5ff3aa8) returned 0x2 [0219.144] IUnknown:Release (This=0x5ff3aa8) returned 0x1 [0219.144] CoGetContextToken (in: pToken=0x452f478 | out: pToken=0x452f478) returned 0x0 [0219.144] WbemLocator:IUnknown:Release (This=0x5ff4f98) returned 0x1 [0219.144] WbemLocator:IUnknown:Release (This=0x5ff4f98) returned 0x0 [0219.144] CoGetContextToken (in: pToken=0x452f478 | out: pToken=0x452f478) returned 0x0 [0219.144] IUnknown:Release (This=0x60021e0) returned 0x2 [0219.144] IUnknown:Release (This=0x60021e0) returned 0x1 [0219.144] CoGetContextToken (in: pToken=0x452f478 | out: pToken=0x452f478) returned 0x0 [0219.144] WbemLocator:IUnknown:Release (This=0x6002fd8) returned 0x1 [0219.144] WbemLocator:IUnknown:Release (This=0x6002fd8) returned 0x0 [0219.144] CoGetContextToken (in: pToken=0x452f478 | out: pToken=0x452f478) returned 0x0 [0219.144] IUnknown:Release (This=0x5fff0d8) returned 0x2 [0219.144] IUnknown:Release (This=0x5fff0d8) returned 0x1 [0219.144] CoGetContextToken (in: pToken=0x452f478 | out: pToken=0x452f478) returned 0x0 [0219.144] WbemLocator:IUnknown:Release (This=0x5ffecf0) returned 0x1 [0219.144] WbemLocator:IUnknown:Release (This=0x5ffecf0) returned 0x0 [0219.144] CoGetContextToken (in: pToken=0x452f478 | out: pToken=0x452f478) returned 0x0 [0219.144] WbemLocator:IUnknown:Release (This=0x5ffed10) returned 0x1 [0219.144] WbemLocator:IUnknown:Release (This=0x5ffed10) returned 0x0 [0219.144] CoGetContextToken (in: pToken=0x452f4f0 | out: pToken=0x452f4f0) returned 0x0 [0219.144] CoGetContextToken (in: pToken=0x452f478 | out: pToken=0x452f478) returned 0x0 [0219.144] WbemDefPath:IUnknown:Release (This=0x5fecc08) returned 0x1 [0219.144] WbemDefPath:IUnknown:Release (This=0x5fecc08) returned 0x0 [0219.144] CoGetContextToken (in: pToken=0x452f478 | out: pToken=0x452f478) returned 0x0 [0219.144] WbemDefPath:IUnknown:Release (This=0x5fe0ba0) returned 0x1 [0219.144] WbemDefPath:IUnknown:Release (This=0x5fe0ba0) returned 0x0 [0219.144] CoGetContextToken (in: pToken=0x452f478 | out: pToken=0x452f478) returned 0x0 [0219.144] WbemDefPath:IUnknown:Release (This=0x5fe0820) returned 0x1 [0219.144] WbemDefPath:IUnknown:Release (This=0x5fe0820) returned 0x0 [0219.144] CoGetContextToken (in: pToken=0x452f478 | out: pToken=0x452f478) returned 0x0 [0219.144] WbemDefPath:IUnknown:Release (This=0x5ff2988) returned 0x1 [0219.145] WbemDefPath:IUnknown:Release (This=0x5ff2988) returned 0x0 [0219.145] CoGetContextToken (in: pToken=0x452f310 | out: pToken=0x452f310) returned 0x0 [0219.145] WbemLocator:IUnknown:Release (This=0x9fad1c) returned 0x1 [0219.145] IUnknown:Release (This=0x5ffebd4) returned 0x0 [0219.146] IUnknown:Release (This=0x60021e0) returned 0x0 [0219.146] CoGetContextToken (in: pToken=0x452f310 | out: pToken=0x452f310) returned 0x0 [0219.146] WbemLocator:IUnknown:Release (This=0x9faa4c) returned 0x1 [0219.146] IUnknown:Release (This=0x5ff3a6c) returned 0x0 [0219.147] CoGetContextToken (in: pToken=0x452f310 | out: pToken=0x452f310) returned 0x0 [0219.147] WbemLocator:IUnknown:Release (This=0x9fafec) returned 0x1 [0219.147] IUnknown:Release (This=0x5fff554) returned 0x0 [0219.147] IUnknown:Release (This=0x5ff3aa8) returned 0x0 [0219.147] CoGetContextToken (in: pToken=0x452f310 | out: pToken=0x452f310) returned 0x0 [0219.147] WbemLocator:IUnknown:Release (This=0x9fb2bc) returned 0x1 [0219.147] IUnknown:Release (This=0x5ffd1cc) returned 0x0 [0219.148] CoGetContextToken (in: pToken=0x452f310 | out: pToken=0x452f310) returned 0x0 [0219.148] WbemLocator:IUnknown:Release (This=0x9fa77c) returned 0x1 [0219.148] IUnknown:Release (This=0x5ff39a4) returned 0x0 [0219.149] IUnknown:Release (This=0x5ff3720) returned 0x0 [0219.149] IUnknown:Release (This=0x5ff2a50) returned 0x0 [0219.149] CloseHandle (hObject=0x3fc) returned 1 [0219.149] CloseHandle (hObject=0x3f4) returned 1 [0219.149] CoGetContextToken (in: pToken=0x452f310 | out: pToken=0x452f310) returned 0x0 [0219.149] WbemLocator:IUnknown:Release (This=0x9fa0ec) returned 0x1 [0219.149] IUnknown:Release (This=0x5ff294c) returned 0x0 [0219.151] IUnknown:Release (This=0x5ff24d0) returned 0x0 [0219.151] IUnknown:Release (This=0x5feefb0) returned 0x0 [0219.151] IUnknown:Release (This=0x5fff0d8) returned 0x0 [0219.151] RegCloseKey (hKey=0x2a4) returned 0x0 [0219.151] CloseHandle (hObject=0x334) returned 1 [0219.151] CloseHandle (hObject=0x48c) returned 1 [0219.151] CloseHandle (hObject=0x330) returned 1 [0219.152] RegCloseKey (hKey=0x298) returned 0x0 [0219.152] CloseHandle (hObject=0x5c8) returned 1 [0219.152] CloseHandle (hObject=0x328) returned 1 [0219.152] RegCloseKey (hKey=0x254) returned 0x0 [0219.153] CloseHandle (hObject=0x47c) returned 1 [0219.153] CloseHandle (hObject=0x358) returned 1 [0219.153] CloseHandle (hObject=0x5c4) returned 1 [0219.153] CloseHandle (hObject=0x354) returned 1 [0219.154] CloseHandle (hObject=0x338) returned 1 [0219.154] CloseHandle (hObject=0x348) returned 1 [0219.154] CloseHandle (hObject=0x32c) returned 1 [0219.154] CloseHandle (hObject=0x5c0) returned 1 [0219.154] CloseHandle (hObject=0x344) returned 1 [0219.154] CloseHandle (hObject=0x4f4) returned 1 [0219.154] CloseHandle (hObject=0x340) returned 1 [0219.154] CloseHandle (hObject=0x33c) returned 1 [0219.155] CloseHandle (hObject=0x4f0) returned 1 [0219.155] CloseHandle (hObject=0x5b8) returned 1 [0219.155] CloseHandle (hObject=0x4d4) returned 1 [0219.155] RegCloseKey (hKey=0x2a0) returned 0x0 [0219.155] RegCloseKey (hKey=0x380) returned 0x0 [0219.159] RegCloseKey (hKey=0x308) returned 0x0 [0224.635] EtwEventUnregister () returned 0x0 [0224.635] EtwEventUnregister () returned 0x0 [0224.635] EtwEventUnregister () returned 0x0 [0224.635] EtwEventUnregister () returned 0x0 [0224.651] LocalFree (hMem=0x9bc758) returned 0x0 [0224.651] LocalFree (hMem=0x9bc6d0) returned 0x0 [0224.651] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x254 [0224.651] PostMessageW (hWnd=0x60152, Msg=0x12, wParam=0x0, lParam=0x0) returned 1 [0224.651] CoGetContextToken (in: pToken=0x452f0cc | out: pToken=0x452f0cc) returned 0x0 [0224.651] IUnknown:QueryInterface (in: This=0x98faa0, riid=0x7463d8c4*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x452f0f0 | out: ppvObject=0x452f0f0*=0x98faac) returned 0x0 [0224.652] IComThreadingInfo:GetCurrentThreadType (in: This=0x98faac, pThreadType=0x452f11c | out: pThreadType=0x452f11c*=0) returned 0x0 [0224.652] IUnknown:Release (This=0x98faac) returned 0x1 [0224.660] CoGetContextToken (in: pToken=0x452f0e4 | out: pToken=0x452f0e4) returned 0x0 [0224.660] IUnknown:QueryInterface (in: This=0x98faa0, riid=0x7463d8c4*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x452f108 | out: ppvObject=0x452f108*=0x98faac) returned 0x0 [0224.660] IComThreadingInfo:GetCurrentThreadType (in: This=0x98faac, pThreadType=0x452f134 | out: pThreadType=0x452f134*=0) returned 0x0 [0224.660] IUnknown:Release (This=0x98faac) returned 0x1 [0224.670] CloseHandle (hObject=0x5ec) returned 1 [0224.675] CloseHandle (hObject=0x308) returned 1 [0224.676] FreeCredentialsHandle (phCredential=0x2513764) returned 0x0 [0224.676] DeleteSecurityContext (phContext=0x2513958) returned 0x0 [0224.677] CloseHandle (hObject=0x348) returned 1 [0224.678] CertFreeCRLContext (pCrlContext=0x6e99060) returned 1 [0224.678] CertFreeCRLContext (pCrlContext=0x6e99010) returned 1 [0224.679] setsockopt (s=0x32c, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0224.679] closesocket (s=0x32c) returned 0 [0224.680] CertFreeCRLContext (pCrlContext=0x609ee18) returned 1 [0224.680] CloseHandle (hObject=0x2a0) returned 1 [0224.681] CertCloseStore (hCertStore=0x60ac380, dwFlags=0x0) returned 1 [0224.681] CertFreeCRLContext (pCrlContext=0x609ee18) returned 1 [0224.682] CertFreeCRLContext (pCrlContext=0x609ee68) returned 1 [0224.686] CertFreeCRLContext (pCrlContext=0x609eeb8) returned 1 [0224.686] CloseHandle (hObject=0x30c) returned 1 [0224.687] WinHttpCloseHandle (hInternet=0xa087b0) returned 1 [0224.688] CloseHandle (hObject=0x57c) returned 1 [0224.688] CloseHandle (hObject=0x578) returned 1 [0224.688] RegCloseKey (hKey=0x574) returned 0x0 [0224.688] CloseHandle (hObject=0x570) returned 1 [0224.688] RegCloseKey (hKey=0x56c) returned 0x0 [0224.689] CloseHandle (hObject=0x568) returned 1 [0224.689] CloseHandle (hObject=0x2a8) returned 1 [0224.689] RegCloseKey (hKey=0x564) returned 0x0 [0224.689] RegCloseKey (hKey=0x560) returned 0x0 [0224.690] CloseHandle (hObject=0x548) returned 1 [0224.690] setsockopt (s=0x53c, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0224.690] closesocket (s=0x53c) returned 0 [0224.690] CloseHandle (hObject=0x540) returned 1 [0224.691] setsockopt (s=0x538, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0224.691] closesocket (s=0x538) returned 0 [0224.691] CloseHandle (hObject=0x41c) returned 1 [0224.691] FreeLibrary (hLibModule=0x6f070000) returned 1 [0224.695] setsockopt (s=0x604, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0224.695] closesocket (s=0x604) returned 0 [0224.696] CloseHandle (hObject=0x608) returned 1 [0224.696] setsockopt (s=0x5f8, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0224.696] closesocket (s=0x5f8) returned 0 [0224.696] CloseHandle (hObject=0x600) returned 1 [0224.696] setsockopt (s=0x5f0, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0224.697] closesocket (s=0x5f0) returned 0 [0224.698] CloseHandle (hObject=0x254) returned 1 [0224.698] UnmapViewOfFile (lpBaseAddress=0x6b0000) returned 1 [0224.699] CloseHandle (hObject=0x380) returned 1 [0224.700] CloseHandle (hObject=0x418) returned 1 [0224.700] RegCloseKey (hKey=0x80000004) returned 0x0 [0224.702] CoGetContextToken (in: pToken=0x452f138 | out: pToken=0x452f138) returned 0x0 [0224.702] CoGetContextToken (in: pToken=0x452f0c0 | out: pToken=0x452f0c0) returned 0x0 [0224.702] WbemDefPath:IUnknown:Release (This=0x5fe09c0) returned 0x1 [0224.702] WbemDefPath:IUnknown:Release (This=0x5fe09c0) returned 0x0 [0224.702] CoGetContextToken (in: pToken=0x452f0c0 | out: pToken=0x452f0c0) returned 0x0 [0224.702] WbemDefPath:IUnknown:Release (This=0x5ff2e10) returned 0x1 [0224.702] WbemDefPath:IUnknown:Release (This=0x5ff2e10) returned 0x0 [0224.702] CoGetContextToken (in: pToken=0x452f0c0 | out: pToken=0x452f0c0) returned 0x0 [0224.702] WbemDefPath:IUnknown:Release (This=0x5fef198) returned 0x1 [0224.702] WbemDefPath:IUnknown:Release (This=0x5fef198) returned 0x0 [0224.703] CoGetContextToken (in: pToken=0x452f0c0 | out: pToken=0x452f0c0) returned 0x0 [0224.703] WbemDefPath:IUnknown:Release (This=0x5ff3dd8) returned 0x1 [0224.703] WbemDefPath:IUnknown:Release (This=0x5ff3dd8) returned 0x0 [0224.703] CoGetContextToken (in: pToken=0x452f0c0 | out: pToken=0x452f0c0) returned 0x0 [0224.703] WbemDefPath:IUnknown:Release (This=0x5ffca70) returned 0x1 [0224.703] WbemDefPath:IUnknown:Release (This=0x5ffca70) returned 0x0 [0224.703] CoGetContextToken (in: pToken=0x452f0c0 | out: pToken=0x452f0c0) returned 0x0 [0224.703] WbemDefPath:IUnknown:Release (This=0x5fef6f8) returned 0x1 [0224.703] WbemDefPath:IUnknown:Release (This=0x5fef6f8) returned 0x0 [0224.703] CoGetContextToken (in: pToken=0x452f0c0 | out: pToken=0x452f0c0) returned 0x0 [0224.703] WbemDefPath:IUnknown:Release (This=0x5ff4f28) returned 0x1 [0224.703] WbemDefPath:IUnknown:Release (This=0x5ff4f28) returned 0x0 [0224.703] CoGetContextToken (in: pToken=0x452f0c0 | out: pToken=0x452f0c0) returned 0x0 [0224.703] WbemDefPath:IUnknown:Release (This=0x6002118) returned 0x1 [0224.703] WbemDefPath:IUnknown:Release (This=0x6002118) returned 0x0 [0224.703] CoGetContextToken (in: pToken=0x452f0c0 | out: pToken=0x452f0c0) returned 0x0 [0224.703] WbemDefPath:IUnknown:Release (This=0x5ff27c0) returned 0x1 [0224.703] WbemDefPath:IUnknown:Release (This=0x5ff27c0) returned 0x0 [0224.703] CoGetContextToken (in: pToken=0x452f0c0 | out: pToken=0x452f0c0) returned 0x0 [0224.703] WbemDefPath:IUnknown:Release (This=0x5ffec10) returned 0x1 [0224.704] WbemDefPath:IUnknown:Release (This=0x5ffec10) returned 0x0 [0224.704] CoGetContextToken (in: pToken=0x452f0c0 | out: pToken=0x452f0c0) returned 0x0 [0224.704] WbemDefPath:IUnknown:Release (This=0x5fff270) returned 0x1 [0224.704] WbemDefPath:IUnknown:Release (This=0x5fff270) returned 0x0 [0224.704] CoGetContextToken (in: pToken=0x452f138 | out: pToken=0x452f138) returned 0x0 [0224.704] CoGetContextToken (in: pToken=0x452f0c0 | out: pToken=0x452f0c0) returned 0x0 [0224.704] WbemLocator:IUnknown:Release (This=0x9fa86c) returned 0x1 [0224.704] WbemLocator:IUnknown:Release (This=0x5ff4fec) returned 0x0 [0224.705] CoGetContextToken (in: pToken=0x452f0c0 | out: pToken=0x452f0c0) returned 0x0 [0224.705] WbemLocator:IUnknown:Release (This=0x9fa59c) returned 0x1 [0224.705] WbemLocator:IUnknown:Release (This=0x5ff28ac) returned 0x0 [0224.705] CoGetContextToken (in: pToken=0x452f0c0 | out: pToken=0x452f0c0) returned 0x0 [0224.705] WbemLocator:IUnknown:Release (This=0x9fab3c) returned 0x1 [0224.705] WbemLocator:IUnknown:Release (This=0x5ff3f14) returned 0x0 [0224.706] CoGetContextToken (in: pToken=0x452f0c0 | out: pToken=0x452f0c0) returned 0x0 [0224.706] WbemLocator:IUnknown:Release (This=0x9fb0dc) returned 0x1 [0224.706] WbemLocator:IUnknown:Release (This=0x5ffecc4) returned 0x0 [0224.706] CoGetContextToken (in: pToken=0x452f0c0 | out: pToken=0x452f0c0) returned 0x0 [0224.706] WbemLocator:IUnknown:Release (This=0x9fb3ac) returned 0x1 [0224.706] WbemLocator:IUnknown:Release (This=0x5fff3a4) returned 0x0 [0224.706] CoGetContextToken (in: pToken=0x452f0c0 | out: pToken=0x452f0c0) returned 0x0 [0224.706] WbemLocator:IUnknown:Release (This=0x9fae0c) returned 0x1 [0224.706] WbemLocator:IUnknown:Release (This=0x60021cc) returned 0x0 [0224.707] CoGetContextToken (in: pToken=0x452f0c0 | out: pToken=0x452f0c0) returned 0x0 [0224.707] WbemLocator:IUnknown:Release (This=0x9fa4ac) returned 0x1 [0224.707] WbemLocator:IUnknown:Release (This=0x5fef7f4) returned 0x0 [0224.707] IUnknown:Release (This=0x98faa0) returned 0x0 [0224.708] SleepEx (dwMilliseconds=0xffffffff, bAlertable=0) Thread: id = 89 os_tid = 0x440 Thread: id = 90 os_tid = 0x43c [0193.282] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0193.283] CoGetContextToken (in: pToken=0x539f904 | out: pToken=0x539f904) returned 0x0 [0193.283] CObjectContext::QueryInterface () returned 0x0 [0193.283] CObjectContext::GetCurrentThreadType () returned 0x0 [0193.283] Release () returned 0x0 [0193.283] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0193.283] CoUninitialize () [0193.377] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.419] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.420] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.421] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.424] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.424] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.424] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.424] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.424] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.424] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.424] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.424] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.424] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.424] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.424] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.424] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.424] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.424] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.424] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.424] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.424] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.425] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.425] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.425] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.425] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.425] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.425] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.425] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.425] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.425] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.425] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.425] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.425] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.425] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.425] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.425] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.425] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.425] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.425] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.425] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.425] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.425] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.426] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.426] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.426] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.426] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.426] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.426] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.426] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0193.426] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0194.470] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x298) returned 0x0 [0194.471] RegQueryInfoKeyW (in: hKey=0x298, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x539f454, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x539f450, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x539f454*=0x30, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x539f450*=0x0, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.471] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x0, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="AddressBook", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.471] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x1, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Adobe Flash Player Plugin", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.471] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x2, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Connection Manager", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.471] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x3, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="DirectDrawEx", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.471] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x4, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Fontcore", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.471] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x5, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Google Chrome", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.472] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x6, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IE40", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.472] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x7, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IE4Data", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.472] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x8, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IE5BAKEX", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.472] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x9, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IEData", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.472] RegEnumKeyExW (in: hKey=0x298, dwIndex=0xa, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="MobileOptionPack", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.472] RegEnumKeyExW (in: hKey=0x298, dwIndex=0xb, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Mozilla Firefox 25.0 (x86 en-US)", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.472] RegEnumKeyExW (in: hKey=0x298, dwIndex=0xc, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="MozillaMaintenanceService", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.472] RegEnumKeyExW (in: hKey=0x298, dwIndex=0xd, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="SchedulingAgent", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.472] RegEnumKeyExW (in: hKey=0x298, dwIndex=0xe, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="VMRayVMTools", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.472] RegEnumKeyExW (in: hKey=0x298, dwIndex=0xf, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="WIC", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.472] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x10, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.472] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x11, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.472] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x12, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.472] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x13, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.472] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x14, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.472] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x15, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.472] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x16, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.472] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x17, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.473] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x18, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{26A24AE4-039D-4CA4-87B4-2F83217045FF}", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.473] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x19, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.473] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x1a, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.473] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x1b, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{4A03706F-666A-4037-7777-5F2748764D10}", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.473] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x1c, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{582EA838-9199-3518-A05C-DB09462F68EC}", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.473] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x1d, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{68306422-7C57-373F-8860-D26CE4BA2A15}", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.473] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x1e, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.473] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x1f, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{9BE518E6-ECC6-35A9-88E4-87755C07200F}", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.473] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x20, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{AC76BA86-7AD7-FFFF-7B44-AA0000000001}", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.473] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x21, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{B175520C-86A2-35A7-8619-86DC379688B9}", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.473] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x22, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.473] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x23, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.473] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x24, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{e52a6842-b0ac-476e-b48f-378a97a67346}", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.473] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x25, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.473] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x26, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.473] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x27, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.474] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x28, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.474] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x29, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.474] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x2a, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.474] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x2b, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.474] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x2c, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.474] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x2d, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.474] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x2e, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{f325f05b-f963-4640-a43b-c8a494cdda0f}", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.474] RegEnumKeyExW (in: hKey=0x298, dwIndex=0x2f, lpName=0x2464bc4, lpcchName=0x539f470, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}", lpcchName=0x539f470, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0194.474] RegOpenKeyExW (in: hKey=0x298, lpSubKey="AddressBook", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x294) returned 0x0 [0194.474] RegQueryValueExW (in: hKey=0x294, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.474] RegQueryValueExW (in: hKey=0x294, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.474] RegOpenKeyExW (in: hKey=0x298, lpSubKey="Adobe Flash Player Plugin", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x29c) returned 0x0 [0194.474] RegQueryValueExW (in: hKey=0x29c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x1, lpData=0x0, lpcbData=0x539f448*=0x3a) returned 0x0 [0194.474] RegQueryValueExW (in: hKey=0x29c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x2465ef4, lpcbData=0x539f448*=0x3a | out: lpType=0x539f44c*=0x1, lpData="Adobe Flash Player 10 Plugin", lpcbData=0x539f448*=0x3a) returned 0x0 [0194.474] RegQueryValueExW (in: hKey=0x29c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x1, lpData=0x0, lpcbData=0x539f448*=0x18) returned 0x0 [0194.475] RegQueryValueExW (in: hKey=0x29c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x2465f84, lpcbData=0x539f448*=0x18 | out: lpType=0x539f44c*=0x1, lpData="10.3.183.75", lpcbData=0x539f448*=0x18) returned 0x0 [0194.475] RegOpenKeyExW (in: hKey=0x298, lpSubKey="Connection Manager", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x2a0) returned 0x0 [0194.475] RegQueryValueExW (in: hKey=0x2a0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.475] RegQueryValueExW (in: hKey=0x2a0, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.475] RegOpenKeyExW (in: hKey=0x298, lpSubKey="DirectDrawEx", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x2a4) returned 0x0 [0194.475] RegQueryValueExW (in: hKey=0x2a4, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.475] RegQueryValueExW (in: hKey=0x2a4, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.475] RegOpenKeyExW (in: hKey=0x298, lpSubKey="Fontcore", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x2a8) returned 0x0 [0194.475] RegQueryValueExW (in: hKey=0x2a8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.475] RegQueryValueExW (in: hKey=0x2a8, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.475] RegOpenKeyExW (in: hKey=0x298, lpSubKey="Google Chrome", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x2ac) returned 0x0 [0194.475] RegQueryValueExW (in: hKey=0x2ac, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x1, lpData=0x0, lpcbData=0x539f448*=0x1c) returned 0x0 [0194.475] RegQueryValueExW (in: hKey=0x2ac, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x2466404, lpcbData=0x539f448*=0x1c | out: lpType=0x539f44c*=0x1, lpData="Google Chrome", lpcbData=0x539f448*=0x1c) returned 0x0 [0194.476] RegQueryValueExW (in: hKey=0x2ac, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x1, lpData=0x0, lpcbData=0x539f448*=0x1c) returned 0x0 [0194.476] RegQueryValueExW (in: hKey=0x2ac, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x2466454, lpcbData=0x539f448*=0x1c | out: lpType=0x539f44c*=0x1, lpData="58.0.3029.110", lpcbData=0x539f448*=0x1c) returned 0x0 [0194.476] RegOpenKeyExW (in: hKey=0x298, lpSubKey="IE40", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x2b0) returned 0x0 [0194.476] RegQueryValueExW (in: hKey=0x2b0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.476] RegQueryValueExW (in: hKey=0x2b0, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.476] RegOpenKeyExW (in: hKey=0x298, lpSubKey="IE4Data", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x2b4) returned 0x0 [0194.476] RegQueryValueExW (in: hKey=0x2b4, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.476] RegQueryValueExW (in: hKey=0x2b4, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.476] RegOpenKeyExW (in: hKey=0x298, lpSubKey="IE5BAKEX", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x2b8) returned 0x0 [0194.476] RegQueryValueExW (in: hKey=0x2b8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.476] RegQueryValueExW (in: hKey=0x2b8, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.476] RegOpenKeyExW (in: hKey=0x298, lpSubKey="IEData", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x2bc) returned 0x0 [0194.476] RegQueryValueExW (in: hKey=0x2bc, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.476] RegQueryValueExW (in: hKey=0x2bc, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.476] RegOpenKeyExW (in: hKey=0x298, lpSubKey="MobileOptionPack", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x2c0) returned 0x0 [0194.477] RegQueryValueExW (in: hKey=0x2c0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.477] RegQueryValueExW (in: hKey=0x2c0, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.477] RegOpenKeyExW (in: hKey=0x298, lpSubKey="Mozilla Firefox 25.0 (x86 en-US)", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x2c4) returned 0x0 [0194.477] RegQueryValueExW (in: hKey=0x2c4, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x1, lpData=0x0, lpcbData=0x539f448*=0x42) returned 0x0 [0194.477] RegQueryValueExW (in: hKey=0x2c4, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x2466a78, lpcbData=0x539f448*=0x42 | out: lpType=0x539f44c*=0x1, lpData="Mozilla Firefox 25.0 (x86 en-US)", lpcbData=0x539f448*=0x42) returned 0x0 [0194.477] RegQueryValueExW (in: hKey=0x2c4, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x1, lpData=0x0, lpcbData=0x539f448*=0xa) returned 0x0 [0194.477] RegQueryValueExW (in: hKey=0x2c4, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x2466b18, lpcbData=0x539f448*=0xa | out: lpType=0x539f44c*=0x1, lpData="25.0", lpcbData=0x539f448*=0xa) returned 0x0 [0194.477] RegOpenKeyExW (in: hKey=0x298, lpSubKey="MozillaMaintenanceService", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x2c8) returned 0x0 [0194.477] RegQueryValueExW (in: hKey=0x2c8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x1, lpData=0x0, lpcbData=0x539f448*=0x38) returned 0x0 [0194.477] RegQueryValueExW (in: hKey=0x2c8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x2466cac, lpcbData=0x539f448*=0x38 | out: lpType=0x539f44c*=0x1, lpData="Mozilla Maintenance Service", lpcbData=0x539f448*=0x38) returned 0x0 [0194.477] RegQueryValueExW (in: hKey=0x2c8, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x1, lpData=0x0, lpcbData=0x539f448*=0xa) returned 0x0 [0194.477] RegQueryValueExW (in: hKey=0x2c8, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x2466d34, lpcbData=0x539f448*=0xa | out: lpType=0x539f44c*=0x1, lpData="25.0", lpcbData=0x539f448*=0xa) returned 0x0 [0194.477] RegOpenKeyExW (in: hKey=0x298, lpSubKey="SchedulingAgent", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x2cc) returned 0x0 [0194.477] RegQueryValueExW (in: hKey=0x2cc, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.477] RegQueryValueExW (in: hKey=0x2cc, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.478] RegOpenKeyExW (in: hKey=0x298, lpSubKey="VMRayVMTools", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x2d0) returned 0x0 [0194.478] RegQueryValueExW (in: hKey=0x2d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x1, lpData=0x0, lpcbData=0x539f448*=0x18) returned 0x0 [0194.478] RegQueryValueExW (in: hKey=0x2d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x2466f98, lpcbData=0x539f448*=0x18 | out: lpType=0x539f44c*=0x1, lpData="VMRay Tools", lpcbData=0x539f448*=0x18) returned 0x0 [0194.478] RegQueryValueExW (in: hKey=0x2d0, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x1, lpData=0x0, lpcbData=0x539f448*=0xc) returned 0x0 [0194.478] RegQueryValueExW (in: hKey=0x2d0, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x2466fe0, lpcbData=0x539f448*=0xc | out: lpType=0x539f44c*=0x1, lpData="3.0.0", lpcbData=0x539f448*=0xc) returned 0x0 [0194.478] RegOpenKeyExW (in: hKey=0x298, lpSubKey="WIC", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x2d4) returned 0x0 [0194.478] RegQueryValueExW (in: hKey=0x2d4, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.478] RegQueryValueExW (in: hKey=0x2d4, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.478] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x2d8) returned 0x0 [0194.478] RegQueryValueExW (in: hKey=0x2d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x1, lpData=0x0, lpcbData=0x539f448*=0x76) returned 0x0 [0194.478] RegQueryValueExW (in: hKey=0x2d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x246726c, lpcbData=0x539f448*=0x76 | out: lpType=0x539f44c*=0x1, lpData="Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005", lpcbData=0x539f448*=0x76) returned 0x0 [0194.478] RegQueryValueExW (in: hKey=0x2d8, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x1, lpData=0x0, lpcbData=0x539f448*=0x16) returned 0x0 [0194.478] RegQueryValueExW (in: hKey=0x2d8, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x2467374, lpcbData=0x539f448*=0x16 | out: lpType=0x539f44c*=0x1, lpData="12.0.21005", lpcbData=0x539f448*=0x16) returned 0x0 [0194.478] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x2dc) returned 0x0 [0194.478] RegQueryValueExW (in: hKey=0x2dc, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.479] RegQueryValueExW (in: hKey=0x2dc, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.479] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x2e0) returned 0x0 [0194.479] RegQueryValueExW (in: hKey=0x2e0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.479] RegQueryValueExW (in: hKey=0x2e0, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.479] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x2e4) returned 0x0 [0194.479] RegQueryValueExW (in: hKey=0x2e4, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.479] RegQueryValueExW (in: hKey=0x2e4, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.479] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x2e8) returned 0x0 [0194.479] RegQueryValueExW (in: hKey=0x2e8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.479] RegQueryValueExW (in: hKey=0x2e8, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.479] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x2ec) returned 0x0 [0194.479] RegQueryValueExW (in: hKey=0x2ec, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.479] RegQueryValueExW (in: hKey=0x2ec, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.479] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x2f0) returned 0x0 [0194.480] RegQueryValueExW (in: hKey=0x2f0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.480] RegQueryValueExW (in: hKey=0x2f0, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.480] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x2f4) returned 0x0 [0194.480] RegQueryValueExW (in: hKey=0x2f4, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.480] RegQueryValueExW (in: hKey=0x2f4, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.480] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{26A24AE4-039D-4CA4-87B4-2F83217045FF}", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x2f8) returned 0x0 [0194.480] RegQueryValueExW (in: hKey=0x2f8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x1, lpData=0x0, lpcbData=0x539f448*=0x22) returned 0x0 [0194.480] RegQueryValueExW (in: hKey=0x2f8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x2467de4, lpcbData=0x539f448*=0x22 | out: lpType=0x539f44c*=0x1, lpData="Java 7 Update 45", lpcbData=0x539f448*=0x22) returned 0x0 [0194.480] RegQueryValueExW (in: hKey=0x2f8, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x1, lpData=0x0, lpcbData=0x539f448*=0x10) returned 0x0 [0194.480] RegQueryValueExW (in: hKey=0x2f8, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x2467e44, lpcbData=0x539f448*=0x10 | out: lpType=0x539f44c*=0x1, lpData="7.0.450", lpcbData=0x539f448*=0x10) returned 0x0 [0194.480] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x2fc) returned 0x0 [0194.480] RegQueryValueExW (in: hKey=0x2fc, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x1, lpData=0x0, lpcbData=0x539f448*=0x7a) returned 0x0 [0194.480] RegQueryValueExW (in: hKey=0x2fc, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x2467fe0, lpcbData=0x539f448*=0x7a | out: lpType=0x539f44c*=0x1, lpData="Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030", lpcbData=0x539f448*=0x7a) returned 0x0 [0194.480] RegQueryValueExW (in: hKey=0x2fc, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x1, lpData=0x0, lpcbData=0x539f448*=0x1a) returned 0x0 [0194.481] RegQueryValueExW (in: hKey=0x2fc, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x24680f0, lpcbData=0x539f448*=0x1a | out: lpType=0x539f44c*=0x1, lpData="11.0.61030.0", lpcbData=0x539f448*=0x1a) returned 0x0 [0194.481] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{3c3aafc8-d898-43ec-998f-965ffdae065a}", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x300) returned 0x0 [0194.481] RegQueryValueExW (in: hKey=0x300, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x1, lpData=0x0, lpcbData=0x539f448*=0x7a) returned 0x0 [0194.481] RegQueryValueExW (in: hKey=0x300, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x2468304, lpcbData=0x539f448*=0x7a | out: lpType=0x539f44c*=0x1, lpData="Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501", lpcbData=0x539f448*=0x7a) returned 0x0 [0194.481] RegQueryValueExW (in: hKey=0x300, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x1, lpData=0x0, lpcbData=0x539f448*=0x1a) returned 0x0 [0194.481] RegQueryValueExW (in: hKey=0x300, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x2468414, lpcbData=0x539f448*=0x1a | out: lpType=0x539f44c*=0x1, lpData="12.0.30501.0", lpcbData=0x539f448*=0x1a) returned 0x0 [0194.481] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{4A03706F-666A-4037-7777-5F2748764D10}", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x304) returned 0x0 [0194.481] RegQueryValueExW (in: hKey=0x304, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x1, lpData=0x0, lpcbData=0x539f448*=0x24) returned 0x0 [0194.481] RegQueryValueExW (in: hKey=0x304, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x2468674, lpcbData=0x539f448*=0x24 | out: lpType=0x539f44c*=0x1, lpData="Java Auto Updater", lpcbData=0x539f448*=0x24) returned 0x0 [0194.481] RegQueryValueExW (in: hKey=0x304, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x1, lpData=0x0, lpcbData=0x539f448*=0x10) returned 0x0 [0194.481] RegQueryValueExW (in: hKey=0x304, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x24686d4, lpcbData=0x539f448*=0x10 | out: lpType=0x539f44c*=0x1, lpData="2.1.9.8", lpcbData=0x539f448*=0x10) returned 0x0 [0194.481] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{582EA838-9199-3518-A05C-DB09462F68EC}", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x308) returned 0x0 [0194.481] RegQueryValueExW (in: hKey=0x308, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x1, lpData=0x0, lpcbData=0x539f448*=0x78) returned 0x0 [0194.481] RegQueryValueExW (in: hKey=0x308, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x2468870, lpcbData=0x539f448*=0x78 | out: lpType=0x539f44c*=0x1, lpData="Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017", lpcbData=0x539f448*=0x78) returned 0x0 [0194.481] RegQueryValueExW (in: hKey=0x308, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x1, lpData=0x0, lpcbData=0x539f448*=0x18) returned 0x0 [0194.482] RegQueryValueExW (in: hKey=0x308, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x2468978, lpcbData=0x539f448*=0x18 | out: lpType=0x539f44c*=0x1, lpData="14.10.25017", lpcbData=0x539f448*=0x18) returned 0x0 [0194.482] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{68306422-7C57-373F-8860-D26CE4BA2A15}", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x30c) returned 0x0 [0194.482] RegQueryValueExW (in: hKey=0x30c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x1, lpData=0x0, lpcbData=0x539f448*=0x7e) returned 0x0 [0194.482] RegQueryValueExW (in: hKey=0x30c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x2468b80, lpcbData=0x539f448*=0x7e | out: lpType=0x539f44c*=0x1, lpData="Microsoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017", lpcbData=0x539f448*=0x7e) returned 0x0 [0194.482] RegQueryValueExW (in: hKey=0x30c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x1, lpData=0x0, lpcbData=0x539f448*=0x18) returned 0x0 [0194.482] RegQueryValueExW (in: hKey=0x30c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x2468c98, lpcbData=0x539f448*=0x18 | out: lpType=0x539f44c*=0x1, lpData="14.10.25017", lpcbData=0x539f448*=0x18) returned 0x0 [0194.482] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x310) returned 0x0 [0194.482] RegQueryValueExW (in: hKey=0x310, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x1, lpData=0x0, lpcbData=0x539f448*=0x54) returned 0x0 [0194.482] RegQueryValueExW (in: hKey=0x310, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x2468ea8, lpcbData=0x539f448*=0x54 | out: lpType=0x539f44c*=0x1, lpData="Microsoft Visual C++ 2005 Redistributable", lpcbData=0x539f448*=0x54) returned 0x0 [0194.482] RegQueryValueExW (in: hKey=0x310, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x1, lpData=0x0, lpcbData=0x539f448*=0x14) returned 0x0 [0194.482] RegQueryValueExW (in: hKey=0x310, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x2468f68, lpcbData=0x539f448*=0x14 | out: lpType=0x539f44c*=0x1, lpData="8.0.61001", lpcbData=0x539f448*=0x14) returned 0x0 [0194.482] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{9BE518E6-ECC6-35A9-88E4-87755C07200F}", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x314) returned 0x0 [0194.482] RegQueryValueExW (in: hKey=0x314, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x1, lpData=0x0, lpcbData=0x539f448*=0x7e) returned 0x0 [0194.483] RegQueryValueExW (in: hKey=0x314, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x2469140, lpcbData=0x539f448*=0x7e | out: lpType=0x539f44c*=0x1, lpData="Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161", lpcbData=0x539f448*=0x7e) returned 0x0 [0194.483] RegQueryValueExW (in: hKey=0x314, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x1, lpData=0x0, lpcbData=0x539f448*=0x1e) returned 0x0 [0194.483] RegQueryValueExW (in: hKey=0x314, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x2469258, lpcbData=0x539f448*=0x1e | out: lpType=0x539f44c*=0x1, lpData="9.0.30729.6161", lpcbData=0x539f448*=0x1e) returned 0x0 [0194.483] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{AC76BA86-7AD7-FFFF-7B44-AA0000000001}", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x318) returned 0x0 [0194.483] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x1, lpData=0x0, lpcbData=0x539f448*=0x26) returned 0x0 [0194.483] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x246947c, lpcbData=0x539f448*=0x26 | out: lpType=0x539f44c*=0x1, lpData="Adobe Reader X MUI", lpcbData=0x539f448*=0x26) returned 0x0 [0194.483] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x1, lpData=0x0, lpcbData=0x539f448*=0xe) returned 0x0 [0194.483] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x24694e4, lpcbData=0x539f448*=0xe | out: lpType=0x539f44c*=0x1, lpData="10.0.0", lpcbData=0x539f448*=0xe) returned 0x0 [0194.483] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{B175520C-86A2-35A7-8619-86DC379688B9}", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x31c) returned 0x0 [0194.483] RegQueryValueExW (in: hKey=0x31c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x1, lpData=0x0, lpcbData=0x539f448*=0x7c) returned 0x0 [0194.483] RegQueryValueExW (in: hKey=0x31c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x2469680, lpcbData=0x539f448*=0x7c | out: lpType=0x539f44c*=0x1, lpData="Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030", lpcbData=0x539f448*=0x7c) returned 0x0 [0194.483] RegQueryValueExW (in: hKey=0x31c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x1, lpData=0x0, lpcbData=0x539f448*=0x16) returned 0x0 [0194.483] RegQueryValueExW (in: hKey=0x31c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x2469790, lpcbData=0x539f448*=0x16 | out: lpType=0x539f44c*=0x1, lpData="11.0.61030", lpcbData=0x539f448*=0x16) returned 0x0 [0194.483] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x320) returned 0x0 [0194.483] RegQueryValueExW (in: hKey=0x320, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x1, lpData=0x0, lpcbData=0x539f448*=0x76) returned 0x0 [0194.483] RegQueryValueExW (in: hKey=0x320, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x246999c, lpcbData=0x539f448*=0x76 | out: lpType=0x539f44c*=0x1, lpData="Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030", lpcbData=0x539f448*=0x76) returned 0x0 [0194.484] RegQueryValueExW (in: hKey=0x320, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x1, lpData=0x0, lpcbData=0x539f448*=0x16) returned 0x0 [0194.484] RegQueryValueExW (in: hKey=0x320, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x2469aa4, lpcbData=0x539f448*=0x16 | out: lpType=0x539f44c*=0x1, lpData="11.0.61030", lpcbData=0x539f448*=0x16) returned 0x0 [0194.484] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x324) returned 0x0 [0194.499] RegQueryValueExW (in: hKey=0x324, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x1, lpData=0x0, lpcbData=0x539f448*=0x7a) returned 0x0 [0194.499] RegQueryValueExW (in: hKey=0x324, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x246cae0, lpcbData=0x539f448*=0x7a | out: lpType=0x539f44c*=0x1, lpData="Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030", lpcbData=0x539f448*=0x7a) returned 0x0 [0194.499] RegQueryValueExW (in: hKey=0x324, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x1, lpData=0x0, lpcbData=0x539f448*=0x1a) returned 0x0 [0194.499] RegQueryValueExW (in: hKey=0x324, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x246cbf0, lpcbData=0x539f448*=0x1a | out: lpType=0x539f44c*=0x1, lpData="11.0.61030.0", lpcbData=0x539f448*=0x1a) returned 0x0 [0194.499] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{e52a6842-b0ac-476e-b48f-378a97a67346}", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x32c) returned 0x0 [0194.499] RegQueryValueExW (in: hKey=0x32c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x1, lpData=0x0, lpcbData=0x539f448*=0x7c) returned 0x0 [0194.499] RegQueryValueExW (in: hKey=0x32c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x246ce04, lpcbData=0x539f448*=0x7c | out: lpType=0x539f44c*=0x1, lpData="Microsoft Visual C++ 2017 Redistributable (x64) - 14.10.25017", lpcbData=0x539f448*=0x7c) returned 0x0 [0194.499] RegQueryValueExW (in: hKey=0x32c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x1, lpData=0x0, lpcbData=0x539f448*=0x1c) returned 0x0 [0194.499] RegQueryValueExW (in: hKey=0x32c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x246cf14, lpcbData=0x539f448*=0x1c | out: lpType=0x539f44c*=0x1, lpData="14.10.25017.0", lpcbData=0x539f448*=0x1c) returned 0x0 [0194.499] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x330) returned 0x0 [0194.499] RegQueryValueExW (in: hKey=0x330, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x1, lpData=0x0, lpcbData=0x539f448*=0x7a) returned 0x0 [0194.499] RegQueryValueExW (in: hKey=0x330, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x246d12c, lpcbData=0x539f448*=0x7a | out: lpType=0x539f44c*=0x1, lpData="Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501", lpcbData=0x539f448*=0x7a) returned 0x0 [0194.499] RegQueryValueExW (in: hKey=0x330, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x1, lpData=0x0, lpcbData=0x539f448*=0x1a) returned 0x0 [0194.500] RegQueryValueExW (in: hKey=0x330, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x246d23c, lpcbData=0x539f448*=0x1a | out: lpType=0x539f44c*=0x1, lpData="12.0.30501.0", lpcbData=0x539f448*=0x1a) returned 0x0 [0194.500] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x334) returned 0x0 [0194.500] RegQueryValueExW (in: hKey=0x334, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x1, lpData=0x0, lpcbData=0x539f448*=0x78) returned 0x0 [0194.500] RegQueryValueExW (in: hKey=0x334, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x246d450, lpcbData=0x539f448*=0x78 | out: lpType=0x539f44c*=0x1, lpData="Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219", lpcbData=0x539f448*=0x78) returned 0x0 [0194.500] RegQueryValueExW (in: hKey=0x334, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x1, lpData=0x0, lpcbData=0x539f448*=0x16) returned 0x0 [0194.500] RegQueryValueExW (in: hKey=0x334, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x246d558, lpcbData=0x539f448*=0x16 | out: lpType=0x539f44c*=0x1, lpData="10.0.40219", lpcbData=0x539f448*=0x16) returned 0x0 [0194.500] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x338) returned 0x0 [0194.500] RegQueryValueExW (in: hKey=0x338, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.500] RegQueryValueExW (in: hKey=0x338, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.500] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x33c) returned 0x0 [0194.500] RegQueryValueExW (in: hKey=0x33c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.500] RegQueryValueExW (in: hKey=0x33c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.500] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x340) returned 0x0 [0194.500] RegQueryValueExW (in: hKey=0x340, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.500] RegQueryValueExW (in: hKey=0x340, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.501] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x344) returned 0x0 [0194.501] RegQueryValueExW (in: hKey=0x344, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.501] RegQueryValueExW (in: hKey=0x344, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.501] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x348) returned 0x0 [0194.501] RegQueryValueExW (in: hKey=0x348, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.501] RegQueryValueExW (in: hKey=0x348, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.501] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x34c) returned 0x0 [0194.501] RegQueryValueExW (in: hKey=0x34c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.501] RegQueryValueExW (in: hKey=0x34c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.501] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x350) returned 0x0 [0194.501] RegQueryValueExW (in: hKey=0x350, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.501] RegQueryValueExW (in: hKey=0x350, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x0, lpData=0x0, lpcbData=0x539f448*=0x0) returned 0x2 [0194.501] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{f325f05b-f963-4640-a43b-c8a494cdda0f}", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x354) returned 0x0 [0194.502] RegQueryValueExW (in: hKey=0x354, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x1, lpData=0x0, lpcbData=0x539f448*=0x7c) returned 0x0 [0194.502] RegQueryValueExW (in: hKey=0x354, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x246dfcc, lpcbData=0x539f448*=0x7c | out: lpType=0x539f44c*=0x1, lpData="Microsoft Visual C++ 2017 Redistributable (x86) - 14.10.25017", lpcbData=0x539f448*=0x7c) returned 0x0 [0194.502] RegQueryValueExW (in: hKey=0x354, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x1, lpData=0x0, lpcbData=0x539f448*=0x1c) returned 0x0 [0194.502] RegQueryValueExW (in: hKey=0x354, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x246e0dc, lpcbData=0x539f448*=0x1c | out: lpType=0x539f44c*=0x1, lpData="14.10.25017.0", lpcbData=0x539f448*=0x1c) returned 0x0 [0194.502] RegOpenKeyExW (in: hKey=0x298, lpSubKey="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}", ulOptions=0x0, samDesired=0x20019, phkResult=0x539f42c | out: phkResult=0x539f42c*=0x358) returned 0x0 [0194.502] RegQueryValueExW (in: hKey=0x358, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x1, lpData=0x0, lpcbData=0x539f448*=0x7c) returned 0x0 [0194.502] RegQueryValueExW (in: hKey=0x358, lpValueName="DisplayName", lpReserved=0x0, lpType=0x539f44c, lpData=0x246e2f4, lpcbData=0x539f448*=0x7c | out: lpType=0x539f44c*=0x1, lpData="Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005", lpcbData=0x539f448*=0x7c) returned 0x0 [0194.502] RegQueryValueExW (in: hKey=0x358, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x0, lpcbData=0x539f448*=0x0 | out: lpType=0x539f44c*=0x1, lpData=0x0, lpcbData=0x539f448*=0x16) returned 0x0 [0194.502] RegQueryValueExW (in: hKey=0x358, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x539f44c, lpData=0x246e404, lpcbData=0x539f448*=0x16 | out: lpType=0x539f44c*=0x1, lpData="12.0.21005", lpcbData=0x539f448*=0x16) returned 0x0 [0194.843] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0195.048] CreatePipe (in: hReadPipe=0x539f278, hWritePipe=0x539f274, lpPipeAttributes=0x539f1f8, nSize=0x0 | out: hReadPipe=0x539f278*=0x3ec, hWritePipe=0x539f274*=0x3f0) returned 1 [0195.049] GetCurrentProcess () returned 0xffffffff [0195.049] GetCurrentProcess () returned 0xffffffff [0195.049] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x3ec, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x539f27c, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x539f27c*=0x3f4) returned 1 [0195.049] CloseHandle (hObject=0x3ec) returned 1 [0195.049] CreatePipe (in: hReadPipe=0x539f278, hWritePipe=0x539f274, lpPipeAttributes=0x539f1f8, nSize=0x0 | out: hReadPipe=0x539f278*=0x3ec, hWritePipe=0x539f274*=0x3f8) returned 1 [0195.049] GetCurrentProcess () returned 0xffffffff [0195.049] GetCurrentProcess () returned 0xffffffff [0195.049] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x3ec, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x539f27c, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x539f27c*=0x3fc) returned 1 [0195.049] CloseHandle (hObject=0x3ec) returned 1 [0195.050] CoTaskMemAlloc (cb=0x20e) returned 0x9da470 [0195.050] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x9da470 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0195.050] CoTaskMemFree (pv=0x9da470) [0195.051] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"cmd.exe\" /C chcp 65001 && netsh wlan show profile | findstr All", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x539f180*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x3f0, hStdError=0x3f8), lpProcessInformation=0x247787c | out: lpCommandLine="\"cmd.exe\" /C chcp 65001 && netsh wlan show profile | findstr All", lpProcessInformation=0x247787c*(hProcess=0x41c, hThread=0x414, dwProcessId=0x654, dwThreadId=0x6a4)) returned 1 [0195.111] CloseHandle (hObject=0x3f0) returned 1 [0195.111] CloseHandle (hObject=0x3f8) returned 1 [0195.129] GetFileType (hFile=0x3f4) returned 0x3 [0195.130] GetFileType (hFile=0x3fc) returned 0x3 [0195.131] CloseHandle (hObject=0x414) returned 1 [0195.131] ReadFile (in: hFile=0x3f4, lpBuffer=0x247cdac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x539f32c, lpOverlapped=0x0 | out: lpBuffer=0x247cdac, lpNumberOfBytesRead=0x539f32c*=0x0, lpOverlapped=0x0) returned 0 [0216.671] GetCurrentProcess () returned 0xffffffff [0216.671] GetCurrentProcess () returned 0xffffffff [0216.672] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x41c, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x539f318, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x539f318*=0x308) returned 1 [0216.674] CloseHandle (hObject=0x308) returned 1 [0216.678] CloseHandle (hObject=0x41c) returned 1 [0216.679] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.680] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.686] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.687] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.688] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.688] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.688] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.688] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.688] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.689] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.689] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.689] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.689] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.689] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.689] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.690] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.690] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.690] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.690] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.690] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.691] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.691] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.691] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.691] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.691] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.899] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.922] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.926] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.930] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.931] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.932] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.933] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.933] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.933] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.934] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.935] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.018] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.019] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.020] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.021] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.021] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.022] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.022] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.022] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.035] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.036] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.036] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.037] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.037] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.038] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.039] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.039] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.044] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.047] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.069] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.116] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.142] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.150] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.160] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.161] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.161] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.161] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.162] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.162] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.162] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.162] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.162] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.163] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.163] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.163] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.163] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.164] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.165] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.166] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.167] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.022] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.027] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.027] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.027] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.028] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.028] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.028] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.028] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.028] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.029] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.029] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.029] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.029] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.029] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.030] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.030] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.030] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.030] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.030] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.031] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.031] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.031] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.031] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.031] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.031] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 Thread: id = 91 os_tid = 0x544 Thread: id = 92 os_tid = 0x688 [0193.336] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0194.138] CoTaskMemAlloc (cb=0x20c) returned 0x9b9c38 [0194.138] SHGetFolderPathW (in: hwnd=0x0, csidl=0, hToken=0x0, dwFlags=0x0, pszPath=0x9b9c38 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x0 [0194.138] CoTaskMemFree (pv=0x9b9c38) [0194.139] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x559d99c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0194.139] CoTaskMemAlloc (cb=0x20c) returned 0x9b9c38 [0194.139] SHGetFolderPathW (in: hwnd=0x0, csidl=39, hToken=0x0, dwFlags=0x0, pszPath=0x9b9c38 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned 0x0 [0194.140] CoTaskMemFree (pv=0x9b9c38) [0194.140] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", nBufferLength=0x105, lpBuffer=0x559d99c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", lpFilePart=0x0) returned 0x26 [0194.140] CoTaskMemAlloc (cb=0x20c) returned 0x9b9c38 [0194.140] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x9b9c38 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned 0x0 [0194.141] CoTaskMemFree (pv=0x9b9c38) [0194.141] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", nBufferLength=0x105, lpBuffer=0x559d99c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", lpFilePart=0x0) returned 0x27 [0194.141] CoTaskMemAlloc (cb=0x20c) returned 0x9b9c38 [0194.141] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x9b9c38 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0194.141] CoTaskMemFree (pv=0x9b9c38) [0194.141] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", nBufferLength=0x105, lpBuffer=0x559d99c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d [0194.141] CoTaskMemAlloc (cb=0x20c) returned 0x9b9c38 [0194.141] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x9b9c38 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x0 [0194.141] CoTaskMemFree (pv=0x9b9c38) [0194.141] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x559d99c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpFilePart=0x0) returned 0x2d [0194.141] CoTaskMemAlloc (cb=0x20c) returned 0x9b9c38 [0194.141] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x9b9c38 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x0 [0194.141] CoTaskMemFree (pv=0x9b9c38) [0194.141] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x559d99c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpFilePart=0x0) returned 0x2d [0194.443] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x559e8d0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0194.444] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\22e94f5071aaed0706b87ec862736685-mat-debug.tmp", nBufferLength=0x105, lpBuffer=0x559e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\22e94f5071aaed0706b87ec862736685-mat-debug.tmp", lpFilePart=0x0) returned 0x80 [0194.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ed44) returned 1 [0194.444] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\22e94f5071aaed0706b87ec862736685-mat-debug.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\22e94f5071aaed0706b87ec862736685-mat-debug.tmp"), fInfoLevelId=0x0, lpFileInformation=0x559edc0 | out: lpFileInformation=0x559edc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0194.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x559ed40) returned 1 [0194.485] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x559e8cc, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0194.486] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", nBufferLength=0x105, lpBuffer=0x559e8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", lpFilePart=0x0) returned 0x72 [0194.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ed7c) returned 1 [0194.486] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89"), fInfoLevelId=0x0, lpFileInformation=0x2469c38 | out: lpFileInformation=0x2469c38*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf5067450, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf5067450, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0194.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x559ed78) returned 1 [0194.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559eda8) returned 1 [0194.488] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", nBufferLength=0x105, lpBuffer=0x559e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", lpFilePart=0x0) returned 0x72 [0194.488] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\", nBufferLength=0x105, lpBuffer=0x559e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\", lpFilePart=0x0) returned 0x73 [0194.489] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\*", lpFindFileData=0x559ead0 | out: lpFindFileData=0x559ead0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf5067450, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf5067450, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b27a0 [0194.491] FindNextFileW (in: hFindFile=0x9b27a0, lpFindFileData=0x559eae0 | out: lpFindFileData=0x559eae0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf5067450, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf5067450, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.491] FindNextFileW (in: hFindFile=0x9b27a0, lpFindFileData=0x559eae0 | out: lpFindFileData=0x559eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf5067450, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf66de3f0, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf66de3f0, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dirs", cAlternateFileName="")) returned 1 [0194.491] FindNextFileW (in: hFindFile=0x9b27a0, lpFindFileData=0x559eae0 | out: lpFindFileData=0x559eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf5067450, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf66de3f0, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf66de3f0, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dirs", cAlternateFileName="")) returned 0 [0194.491] FindClose (in: hFindFile=0x9b27a0 | out: hFindFile=0x9b27a0) returned 1 [0194.491] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x559ed68) returned 1 [0194.491] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x559ed74) returned 1 [0194.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559eda8) returned 1 [0194.492] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", nBufferLength=0x105, lpBuffer=0x559e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", lpFilePart=0x0) returned 0x72 [0194.492] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\", nBufferLength=0x105, lpBuffer=0x559e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\", lpFilePart=0x0) returned 0x73 [0194.492] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\*", lpFindFileData=0x559ead0 | out: lpFindFileData=0x559ead0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf5067450, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf5067450, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b27a0 [0194.493] FindNextFileW (in: hFindFile=0x9b27a0, lpFindFileData=0x559eae0 | out: lpFindFileData=0x559eae0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf5067450, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf5067450, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.493] FindNextFileW (in: hFindFile=0x9b27a0, lpFindFileData=0x559eae0 | out: lpFindFileData=0x559eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf5067450, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf66de3f0, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf66de3f0, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dirs", cAlternateFileName="")) returned 1 [0194.494] FindNextFileW (in: hFindFile=0x9b27a0, lpFindFileData=0x559eae0 | out: lpFindFileData=0x559eae0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0194.494] FindClose (in: hFindFile=0x9b27a0 | out: hFindFile=0x9b27a0) returned 1 [0194.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x559ed68) returned 1 [0194.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x559ed74) returned 1 [0194.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ed48) returned 1 [0194.494] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs"), fInfoLevelId=0x0, lpFileInformation=0x559edc8 | out: lpFileInformation=0x559edc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf5067450, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf66de3f0, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf66de3f0, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0194.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x559ed44) returned 1 [0194.495] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\*", lpFindFileData=0x559ea9c | out: lpFindFileData=0x559ea9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf5067450, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf66de3f0, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf66de3f0, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b27a0 [0194.497] FindNextFileW (in: hFindFile=0x9b27a0, lpFindFileData=0x559eab0 | out: lpFindFileData=0x559eab0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf5067450, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf66de3f0, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf66de3f0, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.497] FindNextFileW (in: hFindFile=0x9b27a0, lpFindFileData=0x559eab0 | out: lpFindFileData=0x559eab0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf59a0990, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf59a0990, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf59a0990, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x3ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.txt", cAlternateFileName="")) returned 1 [0194.498] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Desktop.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs\\desktop.txt")) returned 1 [0194.532] FindNextFileW (in: hFindFile=0x9b27a0, lpFindFileData=0x559eab0 | out: lpFindFileData=0x559eab0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5e896f0, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf5e896f0, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf5e896f0, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x559, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents.txt", cAlternateFileName="DOCUME~1.TXT")) returned 1 [0194.532] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Documents.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs\\documents.txt")) returned 1 [0194.533] FindNextFileW (in: hFindFile=0x9b27a0, lpFindFileData=0x559eab0 | out: lpFindFileData=0x559eab0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf65f9bb0, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf65f9bb0, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf66de3f0, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads.txt", cAlternateFileName="DOWNLO~1.TXT")) returned 1 [0194.533] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Downloads.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs\\downloads.txt")) returned 1 [0194.568] FindNextFileW (in: hFindFile=0x9b27a0, lpFindFileData=0x559eab0 | out: lpFindFileData=0x559eab0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5eaf850, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf5eaf850, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf5eaf850, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x31f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures.txt", cAlternateFileName="")) returned 1 [0194.569] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Pictures.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs\\pictures.txt")) returned 1 [0194.581] FindNextFileW (in: hFindFile=0x9b27a0, lpFindFileData=0x559eab0 | out: lpFindFileData=0x559eab0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf65d3a50, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf65d3a50, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf65d3a50, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Startup.txt", cAlternateFileName="")) returned 1 [0194.581] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Startup.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs\\startup.txt")) returned 1 [0194.653] FindNextFileW (in: hFindFile=0x9b27a0, lpFindFileData=0x559eab0 | out: lpFindFileData=0x559eab0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf65d3a50, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf65d3a50, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf65d3a50, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos.txt", cAlternateFileName="")) returned 1 [0194.653] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Videos.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs\\videos.txt")) returned 1 [0194.653] FindNextFileW (in: hFindFile=0x9b27a0, lpFindFileData=0x559eab0 | out: lpFindFileData=0x559eab0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf65d3a50, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf65d3a50, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf65d3a50, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos.txt", cAlternateFileName="")) returned 0 [0194.654] FindClose (in: hFindFile=0x9b27a0 | out: hFindFile=0x9b27a0) returned 1 [0194.654] RemoveDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs")) returned 1 [0194.663] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", nBufferLength=0x105, lpBuffer=0x559e868, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", lpFilePart=0x0) returned 0x72 [0194.673] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", dwFileAttributes=0x2012) returned 1 [0194.678] GetCurrentProcess () returned 0xffffffff [0194.678] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x559ed7c | out: TokenHandle=0x559ed7c*=0x328) returned 1 [0194.682] GetTokenInformation (in: TokenHandle=0x328, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x559ed7c | out: TokenInformation=0x0, ReturnLength=0x559ed7c) returned 0 [0194.682] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x9b7480 [0194.682] GetTokenInformation (in: TokenHandle=0x328, TokenInformationClass=0x8, TokenInformation=0x9b7480, TokenInformationLength=0x4, ReturnLength=0x559ed7c | out: TokenInformation=0x9b7480, ReturnLength=0x559ed7c) returned 1 [0194.683] LocalFree (hMem=0x9b7480) returned 0x0 [0194.684] DuplicateTokenEx (in: hExistingToken=0x328, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x559ed84 | out: phNewToken=0x559ed84*=0x370) returned 1 [0194.684] CheckTokenMembership (in: TokenHandle=0x370, SidToCheck=0x2477514*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x559ed94 | out: IsMember=0x559ed94) returned 1 [0194.684] CloseHandle (hObject=0x370) returned 1 [0194.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ecf8) returned 1 [0194.789] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x559e800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", lpFilePart=0x0) returned 0x2b [0194.789] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", nBufferLength=0x105, lpBuffer=0x559e7d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", lpFilePart=0x0) returned 0x2c [0194.789] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\*", lpFindFileData=0x559ea20 | out: lpFindFileData=0x559ea20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b27a0 [0194.790] FindNextFileW (in: hFindFile=0x9b27a0, lpFindFileData=0x559ea30 | out: lpFindFileData=0x559ea30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.791] FindNextFileW (in: hFindFile=0x9b27a0, lpFindFileData=0x559ea30 | out: lpFindFileData=0x559ea30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0194.791] FindNextFileW (in: hFindFile=0x9b27a0, lpFindFileData=0x559ea30 | out: lpFindFileData=0x559ea30*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0194.791] FindNextFileW (in: hFindFile=0x9b27a0, lpFindFileData=0x559ea30 | out: lpFindFileData=0x559ea30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apps", cAlternateFileName="")) returned 1 [0194.791] FindNextFileW (in: hFindFile=0x9b27a0, lpFindFileData=0x559ea30 | out: lpFindFileData=0x559ea30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 1 [0194.791] FindNextFileW (in: hFindFile=0x9b27a0, lpFindFileData=0x559ea30 | out: lpFindFileData=0x559ea30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66051ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x66051ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9791f220, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x1a918, dwReserved0=0x0, dwReserved1=0x0, cFileName="GDIPFONTCACHEV1.DAT", cAlternateFileName="GDIPFO~1.DAT")) returned 1 [0194.791] FindNextFileW (in: hFindFile=0x9b27a0, lpFindFileData=0x559ea30 | out: lpFindFileData=0x559ea30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google", cAlternateFileName="")) returned 1 [0194.794] FindNextFileW (in: hFindFile=0x9b27a0, lpFindFileData=0x559ea30 | out: lpFindFileData=0x559ea30*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29175f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29175f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29175f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0194.794] FindNextFileW (in: hFindFile=0x9b27a0, lpFindFileData=0x559ea30 | out: lpFindFileData=0x559ea30*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x8de8eaa0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x126da7, dwReserved0=0x0, dwReserved1=0x0, cFileName="IconCache.db", cAlternateFileName="ICONCA~1.DB")) returned 1 [0194.794] FindNextFileW (in: hFindFile=0x9b27a0, lpFindFileData=0x559ea30 | out: lpFindFileData=0x559ea30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0194.794] FindNextFileW (in: hFindFile=0x9b27a0, lpFindFileData=0x559ea30 | out: lpFindFileData=0x559ea30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1 [0194.794] FindNextFileW (in: hFindFile=0x9b27a0, lpFindFileData=0x559ea30 | out: lpFindFileData=0x559ea30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0194.794] FindNextFileW (in: hFindFile=0x9b27a0, lpFindFileData=0x559ea30 | out: lpFindFileData=0x559ea30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x35fc1fa0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x35fc1fa0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0194.794] FindNextFileW (in: hFindFile=0x9b27a0, lpFindFileData=0x559ea30 | out: lpFindFileData=0x559ea30*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29175f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29175f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29175f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0194.795] FindNextFileW (in: hFindFile=0x9b27a0, lpFindFileData=0x559ea30 | out: lpFindFileData=0x559ea30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 1 [0194.795] FindNextFileW (in: hFindFile=0x9b27a0, lpFindFileData=0x559ea30 | out: lpFindFileData=0x559ea30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0194.795] FindClose (in: hFindFile=0x9b27a0 | out: hFindFile=0x9b27a0) returned 1 [0194.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x559ecb8) returned 1 [0194.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x559ecc4) returned 1 [0194.925] CoTaskMemAlloc (cb=0x20c) returned 0x9d8c90 [0194.925] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x9d8c90 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x0 [0194.926] CoTaskMemFree (pv=0x9d8c90) [0194.926] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x559d0fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpFilePart=0x0) returned 0x2d [0194.930] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox", nBufferLength=0x105, lpBuffer=0x559e8c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox", lpFilePart=0x0) returned 0x3d [0194.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ed20) returned 1 [0194.930] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox"), fInfoLevelId=0x0, lpFileInformation=0x559ed9c | out: lpFileInformation=0x559ed9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0194.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x559ed1c) returned 1 [0194.934] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Waterfox", nBufferLength=0x105, lpBuffer=0x559e8c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Waterfox", lpFilePart=0x0) returned 0x36 [0194.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ed20) returned 1 [0194.934] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Waterfox" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\waterfox"), fInfoLevelId=0x0, lpFileInformation=0x559ed9c | out: lpFileInformation=0x559ed9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0194.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x559ed1c) returned 1 [0194.934] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K-Meleon", nBufferLength=0x105, lpBuffer=0x559e8c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K-Meleon", lpFilePart=0x0) returned 0x36 [0194.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ed20) returned 1 [0194.934] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K-Meleon" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\k-meleon"), fInfoLevelId=0x0, lpFileInformation=0x559ed9c | out: lpFileInformation=0x559ed9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0194.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x559ed1c) returned 1 [0194.934] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Thunderbird", nBufferLength=0x105, lpBuffer=0x559e8c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Thunderbird", lpFilePart=0x0) returned 0x39 [0194.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ed20) returned 1 [0194.934] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Thunderbird" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\thunderbird"), fInfoLevelId=0x0, lpFileInformation=0x559ed9c | out: lpFileInformation=0x559ed9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0194.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x559ed1c) returned 1 [0194.934] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Comodo\\IceDragon", nBufferLength=0x105, lpBuffer=0x559e8c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Comodo\\IceDragon", lpFilePart=0x0) returned 0x3e [0194.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ed20) returned 1 [0194.934] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Comodo\\IceDragon" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\comodo\\icedragon"), fInfoLevelId=0x0, lpFileInformation=0x559ed9c | out: lpFileInformation=0x559ed9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0194.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x559ed1c) returned 1 [0194.935] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\8pecxstudios\\Cyberfox", nBufferLength=0x105, lpBuffer=0x559e8c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\8pecxstudios\\Cyberfox", lpFilePart=0x0) returned 0x43 [0194.935] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ed20) returned 1 [0194.935] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\8pecxstudios\\Cyberfox" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\8pecxstudios\\cyberfox"), fInfoLevelId=0x0, lpFileInformation=0x559ed9c | out: lpFileInformation=0x559ed9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0194.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x559ed1c) returned 1 [0194.935] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\NETGATE Technologies\\BlackHaw", nBufferLength=0x105, lpBuffer=0x559e8c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\NETGATE Technologies\\BlackHaw", lpFilePart=0x0) returned 0x4b [0194.935] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ed20) returned 1 [0194.935] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\NETGATE Technologies\\BlackHaw" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\netgate technologies\\blackhaw"), fInfoLevelId=0x0, lpFileInformation=0x559ed9c | out: lpFileInformation=0x559ed9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0194.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x559ed1c) returned 1 [0194.935] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Moonchild Productions\\Pale Moon", nBufferLength=0x105, lpBuffer=0x559e8c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Moonchild Productions\\Pale Moon", lpFilePart=0x0) returned 0x4d [0194.935] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ed20) returned 1 [0194.935] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Moonchild Productions\\Pale Moon" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\moonchild productions\\pale moon"), fInfoLevelId=0x0, lpFileInformation=0x559ed9c | out: lpFileInformation=0x559ed9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0194.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x559ed1c) returned 1 [0194.941] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default", nBufferLength=0x105, lpBuffer=0x559e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default", lpFilePart=0x0) returned 0x4b [0194.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ed38) returned 1 [0194.941] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default"), fInfoLevelId=0x0, lpFileInformation=0x559edb4 | out: lpFileInformation=0x559edb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c4887c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c4887c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0194.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x559ed34) returned 1 [0209.252] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x559e764, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0209.253] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Cookies.txt", nBufferLength=0x105, lpBuffer=0x559e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Cookies.txt", lpFilePart=0x0) returned 0x7e [0209.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec6c) returned 1 [0209.253] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Cookies.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\cookies.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x380 [0209.254] GetFileType (hFile=0x380) returned 0x1 [0209.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x559ec68) returned 1 [0209.254] GetFileType (hFile=0x380) returned 0x1 [0209.254] SetFilePointer (in: hFile=0x380, lDistanceToMove=0, lpDistanceToMoveHigh=0x559ec40*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x559ec40*=0) returned 0x0 [0209.255] WriteFile (in: hFile=0x380, lpBuffer=0x24564b4*, nNumberOfBytesToWrite=0x4f, lpNumberOfBytesWritten=0x559ed14, lpOverlapped=0x0 | out: lpBuffer=0x24564b4*, lpNumberOfBytesWritten=0x559ed14*=0x4f, lpOverlapped=0x0) returned 1 [0209.256] CloseHandle (hObject=0x380) returned 1 [0209.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ed2c) returned 1 [0209.788] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\NordVPN", nBufferLength=0x105, lpBuffer=0x559e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\NordVPN", lpFilePart=0x0) returned 0x33 [0209.788] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\NordVPN\\", nBufferLength=0x105, lpBuffer=0x559e808, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\NordVPN\\", lpFilePart=0x0) returned 0x34 [0209.788] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\NordVPN\\*", lpFindFileData=0x559ea54 | out: lpFindFileData=0x559ea54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0209.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x559ecf0) returned 1 [0209.799] CoTaskMemAlloc (cb=0x20c) returned 0xa1b150 [0209.799] SHGetFolderPathW (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0xa1b150 | out: pszPath="C:\\ProgramData") returned 0x0 [0209.800] CoTaskMemFree (pv=0xa1b150) [0209.800] GetFullPathNameW (in: lpFileName="C:\\ProgramData", nBufferLength=0x105, lpBuffer=0x559e818, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData", lpFilePart=0x0) returned 0xe [0209.800] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Privax\\HMA! Pro VPN\\license.hmavpn", nBufferLength=0x105, lpBuffer=0x559e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Privax\\HMA! Pro VPN\\license.hmavpn", lpFilePart=0x0) returned 0x31 [0209.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ed10) returned 1 [0209.800] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Privax\\HMA! Pro VPN\\license.hmavpn" (normalized: "c:\\programdata\\privax\\hma! pro vpn\\license.hmavpn"), fInfoLevelId=0x0, lpFileInformation=0x559ed8c | out: lpFileInformation=0x559ed8c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0209.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x559ed0c) returned 1 [0209.816] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\ProtonVPN", nBufferLength=0x105, lpBuffer=0x559e898, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\ProtonVPN", lpFilePart=0x0) returned 0x35 [0209.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ecf4) returned 1 [0209.817] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\ProtonVPN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\protonvpn"), fInfoLevelId=0x0, lpFileInformation=0x559ed70 | out: lpFileInformation=0x559ed70*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0209.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x559ecf0) returned 1 [0209.863] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FileZilla\\", nBufferLength=0x105, lpBuffer=0x559e890, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FileZilla\\", lpFilePart=0x0) returned 0x38 [0209.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ecec) returned 1 [0209.864] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FileZilla\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\filezilla"), fInfoLevelId=0x0, lpFileInformation=0x559ed68 | out: lpFileInformation=0x559ed68*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0209.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x559ece8) returned 1 [0209.871] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GHISLER\\", nBufferLength=0x105, lpBuffer=0x559e8ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GHISLER\\", lpFilePart=0x0) returned 0x36 [0209.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ed08) returned 1 [0209.871] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GHISLER\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ghisler"), fInfoLevelId=0x0, lpFileInformation=0x559ed84 | out: lpFileInformation=0x559ed84*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0209.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x559ed04) returned 1 [0209.872] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GHISLER\\", nBufferLength=0x105, lpBuffer=0x559e8ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GHISLER\\", lpFilePart=0x0) returned 0x36 [0209.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ed74) returned 1 [0209.872] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GHISLER\\", nBufferLength=0x105, lpBuffer=0x559e87c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GHISLER\\", lpFilePart=0x0) returned 0x36 [0209.872] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GHISLER\\", nBufferLength=0x105, lpBuffer=0x559e850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GHISLER\\", lpFilePart=0x0) returned 0x36 [0209.872] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\GHISLER\\*", lpFindFileData=0x559ea9c | out: lpFindFileData=0x559ea9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0209.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x559ed38) returned 1 [0209.881] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mega Limited\\MEGAsync\\", nBufferLength=0x105, lpBuffer=0x559e8b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mega Limited\\MEGAsync\\", lpFilePart=0x0) returned 0x42 [0209.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ed10) returned 1 [0209.882] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mega Limited\\MEGAsync\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mega limited\\megasync"), fInfoLevelId=0x0, lpFileInformation=0x559ed8c | out: lpFileInformation=0x559ed8c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0209.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x559ed0c) returned 1 [0209.901] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\uTorrent\\", nBufferLength=0x105, lpBuffer=0x559e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\uTorrent\\", lpFilePart=0x0) returned 0x37 [0209.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ed0c) returned 1 [0209.901] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\uTorrent\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\utorrent"), fInfoLevelId=0x0, lpFileInformation=0x559ed88 | out: lpFileInformation=0x559ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0209.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x559ed08) returned 1 [0209.901] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\qBittorrent\\BT_backup\\", nBufferLength=0x105, lpBuffer=0x559e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\qBittorrent\\BT_backup\\", lpFilePart=0x0) returned 0x42 [0209.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ed0c) returned 1 [0209.901] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\qBittorrent\\BT_backup\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\qbittorrent\\bt_backup"), fInfoLevelId=0x0, lpFileInformation=0x559ed88 | out: lpFileInformation=0x559ed88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0209.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x559ed08) returned 1 [0209.936] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Valve\\Steam", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed60 | out: phkResult=0x559ed60*=0x0) returned 0x2 [0209.942] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Ubisoft Game Launcher", nBufferLength=0x105, lpBuffer=0x559e8b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Ubisoft Game Launcher", lpFilePart=0x0) returned 0x41 [0209.942] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ed10) returned 1 [0209.942] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Ubisoft Game Launcher" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\ubisoft game launcher"), fInfoLevelId=0x0, lpFileInformation=0x559ed8c | out: lpFileInformation=0x559ed8c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0209.942] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x559ed0c) returned 1 [0210.032] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\.minecraft", nBufferLength=0x105, lpBuffer=0x559e8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\.minecraft", lpFilePart=0x0) returned 0x38 [0210.032] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ed1c) returned 1 [0210.032] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\.minecraft" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\.minecraft"), fInfoLevelId=0x0, lpFileInformation=0x559ed98 | out: lpFileInformation=0x559ed98*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0210.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x559ed18) returned 1 [0210.151] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.153] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.154] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.155] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.156] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.160] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.162] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.163] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.164] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.165] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.166] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.167] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.168] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.169] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.170] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.172] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.173] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.174] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.175] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.176] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.177] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.180] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.182] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.183] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.184] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.186] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.187] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.188] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.190] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed3c | out: phkResult=0x559ed3c*=0x0) returned 0x2 [0210.191] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.192] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.194] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.195] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.197] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.198] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.200] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.201] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.202] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.204] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.205] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.207] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.208] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.210] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.211] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.213] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.214] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.215] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.217] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.218] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.220] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.221] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.222] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.224] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.225] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.231] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.233] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.234] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.236] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed3c | out: phkResult=0x559ed3c*=0x0) returned 0x2 [0210.237] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x254) returned 0x0 [0210.237] RegQueryValueExW (in: hKey=0x254, lpValueName="SMTP Email Address", lpReserved=0x0, lpType=0x559ed30, lpData=0x0, lpcbData=0x559ed2c*=0x0 | out: lpType=0x559ed30*=0x0, lpData=0x0, lpcbData=0x559ed2c*=0x0) returned 0x2 [0210.237] RegCloseKey (hKey=0x254) returned 0x0 [0210.238] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x254) returned 0x0 [0210.238] RegQueryValueExW (in: hKey=0x254, lpValueName="SMTP Server", lpReserved=0x0, lpType=0x559ed30, lpData=0x0, lpcbData=0x559ed2c*=0x0 | out: lpType=0x559ed30*=0x0, lpData=0x0, lpcbData=0x559ed2c*=0x0) returned 0x2 [0210.238] RegCloseKey (hKey=0x254) returned 0x0 [0210.239] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x254) returned 0x0 [0210.239] RegQueryValueExW (in: hKey=0x254, lpValueName="POP3 Server", lpReserved=0x0, lpType=0x559ed30, lpData=0x0, lpcbData=0x559ed2c*=0x0 | out: lpType=0x559ed30*=0x0, lpData=0x0, lpcbData=0x559ed2c*=0x0) returned 0x2 [0210.239] RegCloseKey (hKey=0x254) returned 0x0 [0210.240] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x254) returned 0x0 [0210.240] RegQueryValueExW (in: hKey=0x254, lpValueName="POP3 User Name", lpReserved=0x0, lpType=0x559ed30, lpData=0x0, lpcbData=0x559ed2c*=0x0 | out: lpType=0x559ed30*=0x0, lpData=0x0, lpcbData=0x559ed2c*=0x0) returned 0x2 [0210.240] RegCloseKey (hKey=0x254) returned 0x0 [0210.241] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x254) returned 0x0 [0210.241] RegQueryValueExW (in: hKey=0x254, lpValueName="SMTP User Name", lpReserved=0x0, lpType=0x559ed30, lpData=0x0, lpcbData=0x559ed2c*=0x0 | out: lpType=0x559ed30*=0x0, lpData=0x0, lpcbData=0x559ed2c*=0x0) returned 0x2 [0210.241] RegCloseKey (hKey=0x254) returned 0x0 [0210.242] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x254) returned 0x0 [0210.242] RegQueryValueExW (in: hKey=0x254, lpValueName="NNTP Email Address", lpReserved=0x0, lpType=0x559ed30, lpData=0x0, lpcbData=0x559ed2c*=0x0 | out: lpType=0x559ed30*=0x0, lpData=0x0, lpcbData=0x559ed2c*=0x0) returned 0x2 [0210.242] RegCloseKey (hKey=0x254) returned 0x0 [0210.243] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x254) returned 0x0 [0210.243] RegQueryValueExW (in: hKey=0x254, lpValueName="NNTP User Name", lpReserved=0x0, lpType=0x559ed30, lpData=0x0, lpcbData=0x559ed2c*=0x0 | out: lpType=0x559ed30*=0x0, lpData=0x0, lpcbData=0x559ed2c*=0x0) returned 0x2 [0210.243] RegCloseKey (hKey=0x254) returned 0x0 [0210.244] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x254) returned 0x0 [0210.244] RegQueryValueExW (in: hKey=0x254, lpValueName="NNTP Server", lpReserved=0x0, lpType=0x559ed30, lpData=0x0, lpcbData=0x559ed2c*=0x0 | out: lpType=0x559ed30*=0x0, lpData=0x0, lpcbData=0x559ed2c*=0x0) returned 0x2 [0210.244] RegCloseKey (hKey=0x254) returned 0x0 [0210.245] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x254) returned 0x0 [0210.245] RegQueryValueExW (in: hKey=0x254, lpValueName="IMAP Server", lpReserved=0x0, lpType=0x559ed30, lpData=0x0, lpcbData=0x559ed2c*=0x0 | out: lpType=0x559ed30*=0x0, lpData=0x0, lpcbData=0x559ed2c*=0x0) returned 0x2 [0210.245] RegCloseKey (hKey=0x254) returned 0x0 [0210.246] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x254) returned 0x0 [0210.246] RegQueryValueExW (in: hKey=0x254, lpValueName="IMAP User Name", lpReserved=0x0, lpType=0x559ed30, lpData=0x0, lpcbData=0x559ed2c*=0x0 | out: lpType=0x559ed30*=0x0, lpData=0x0, lpcbData=0x559ed2c*=0x0) returned 0x2 [0210.246] RegCloseKey (hKey=0x254) returned 0x0 [0210.247] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x254) returned 0x0 [0210.247] RegQueryValueExW (in: hKey=0x254, lpValueName="Email", lpReserved=0x0, lpType=0x559ed30, lpData=0x0, lpcbData=0x559ed2c*=0x0 | out: lpType=0x559ed30*=0x0, lpData=0x0, lpcbData=0x559ed2c*=0x0) returned 0x2 [0210.247] RegCloseKey (hKey=0x254) returned 0x0 [0210.248] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x254) returned 0x0 [0210.248] RegQueryValueExW (in: hKey=0x254, lpValueName="HTTP User", lpReserved=0x0, lpType=0x559ed30, lpData=0x0, lpcbData=0x559ed2c*=0x0 | out: lpType=0x559ed30*=0x0, lpData=0x0, lpcbData=0x559ed2c*=0x0) returned 0x2 [0210.248] RegCloseKey (hKey=0x254) returned 0x0 [0210.248] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x254) returned 0x0 [0210.249] RegQueryValueExW (in: hKey=0x254, lpValueName="HTTP Server URL", lpReserved=0x0, lpType=0x559ed30, lpData=0x0, lpcbData=0x559ed2c*=0x0 | out: lpType=0x559ed30*=0x0, lpData=0x0, lpcbData=0x559ed2c*=0x0) returned 0x2 [0210.249] RegCloseKey (hKey=0x254) returned 0x0 [0210.249] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x254) returned 0x0 [0210.249] RegQueryValueExW (in: hKey=0x254, lpValueName="POP3 User", lpReserved=0x0, lpType=0x559ed30, lpData=0x0, lpcbData=0x559ed2c*=0x0 | out: lpType=0x559ed30*=0x0, lpData=0x0, lpcbData=0x559ed2c*=0x0) returned 0x2 [0210.249] RegCloseKey (hKey=0x254) returned 0x0 [0210.250] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x254) returned 0x0 [0210.250] RegQueryValueExW (in: hKey=0x254, lpValueName="IMAP User", lpReserved=0x0, lpType=0x559ed30, lpData=0x0, lpcbData=0x559ed2c*=0x0 | out: lpType=0x559ed30*=0x0, lpData=0x0, lpcbData=0x559ed2c*=0x0) returned 0x2 [0210.250] RegCloseKey (hKey=0x254) returned 0x0 [0210.251] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x254) returned 0x0 [0210.251] RegQueryValueExW (in: hKey=0x254, lpValueName="HTTPMail User Name", lpReserved=0x0, lpType=0x559ed30, lpData=0x0, lpcbData=0x559ed2c*=0x0 | out: lpType=0x559ed30*=0x0, lpData=0x0, lpcbData=0x559ed2c*=0x0) returned 0x2 [0210.251] RegCloseKey (hKey=0x254) returned 0x0 [0210.251] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x254) returned 0x0 [0210.252] RegQueryValueExW (in: hKey=0x254, lpValueName="HTTPMail Server", lpReserved=0x0, lpType=0x559ed30, lpData=0x0, lpcbData=0x559ed2c*=0x0 | out: lpType=0x559ed30*=0x0, lpData=0x0, lpcbData=0x559ed2c*=0x0) returned 0x2 [0210.252] RegCloseKey (hKey=0x254) returned 0x0 [0210.252] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x254) returned 0x0 [0210.252] RegQueryValueExW (in: hKey=0x254, lpValueName="SMTP User", lpReserved=0x0, lpType=0x559ed30, lpData=0x0, lpcbData=0x559ed2c*=0x0 | out: lpType=0x559ed30*=0x0, lpData=0x0, lpcbData=0x559ed2c*=0x0) returned 0x2 [0210.252] RegCloseKey (hKey=0x254) returned 0x0 [0210.253] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x254) returned 0x0 [0210.253] RegQueryValueExW (in: hKey=0x254, lpValueName="POP3 Password2", lpReserved=0x0, lpType=0x559ed30, lpData=0x0, lpcbData=0x559ed2c*=0x0 | out: lpType=0x559ed30*=0x0, lpData=0x0, lpcbData=0x559ed2c*=0x0) returned 0x2 [0210.253] RegCloseKey (hKey=0x254) returned 0x0 [0210.254] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x254) returned 0x0 [0210.254] RegQueryValueExW (in: hKey=0x254, lpValueName="IMAP Password2", lpReserved=0x0, lpType=0x559ed30, lpData=0x0, lpcbData=0x559ed2c*=0x0 | out: lpType=0x559ed30*=0x0, lpData=0x0, lpcbData=0x559ed2c*=0x0) returned 0x2 [0210.254] RegCloseKey (hKey=0x254) returned 0x0 [0210.255] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x254) returned 0x0 [0210.255] RegQueryValueExW (in: hKey=0x254, lpValueName="NNTP Password2", lpReserved=0x0, lpType=0x559ed30, lpData=0x0, lpcbData=0x559ed2c*=0x0 | out: lpType=0x559ed30*=0x0, lpData=0x0, lpcbData=0x559ed2c*=0x0) returned 0x2 [0210.255] RegCloseKey (hKey=0x254) returned 0x0 [0210.256] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x254) returned 0x0 [0210.256] RegQueryValueExW (in: hKey=0x254, lpValueName="HTTPMail Password2", lpReserved=0x0, lpType=0x559ed30, lpData=0x0, lpcbData=0x559ed2c*=0x0 | out: lpType=0x559ed30*=0x0, lpData=0x0, lpcbData=0x559ed2c*=0x0) returned 0x2 [0210.256] RegCloseKey (hKey=0x254) returned 0x0 [0210.256] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x254) returned 0x0 [0210.257] RegQueryValueExW (in: hKey=0x254, lpValueName="SMTP Password2", lpReserved=0x0, lpType=0x559ed30, lpData=0x0, lpcbData=0x559ed2c*=0x0 | out: lpType=0x559ed30*=0x0, lpData=0x0, lpcbData=0x559ed2c*=0x0) returned 0x2 [0210.257] RegCloseKey (hKey=0x254) returned 0x0 [0210.257] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x254) returned 0x0 [0210.257] RegQueryValueExW (in: hKey=0x254, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x559ed30, lpData=0x0, lpcbData=0x559ed2c*=0x0 | out: lpType=0x559ed30*=0x0, lpData=0x0, lpcbData=0x559ed2c*=0x0) returned 0x2 [0210.257] RegCloseKey (hKey=0x254) returned 0x0 [0210.258] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x254) returned 0x0 [0210.258] RegQueryValueExW (in: hKey=0x254, lpValueName="IMAP Password", lpReserved=0x0, lpType=0x559ed30, lpData=0x0, lpcbData=0x559ed2c*=0x0 | out: lpType=0x559ed30*=0x0, lpData=0x0, lpcbData=0x559ed2c*=0x0) returned 0x2 [0210.258] RegCloseKey (hKey=0x254) returned 0x0 [0210.259] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x254) returned 0x0 [0210.259] RegQueryValueExW (in: hKey=0x254, lpValueName="NNTP Password", lpReserved=0x0, lpType=0x559ed30, lpData=0x0, lpcbData=0x559ed2c*=0x0 | out: lpType=0x559ed30*=0x0, lpData=0x0, lpcbData=0x559ed2c*=0x0) returned 0x2 [0210.259] RegCloseKey (hKey=0x254) returned 0x0 [0210.259] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x254) returned 0x0 [0210.260] RegQueryValueExW (in: hKey=0x254, lpValueName="HTTPMail Password", lpReserved=0x0, lpType=0x559ed30, lpData=0x0, lpcbData=0x559ed2c*=0x0 | out: lpType=0x559ed30*=0x0, lpData=0x0, lpcbData=0x559ed2c*=0x0) returned 0x2 [0210.260] RegCloseKey (hKey=0x254) returned 0x0 [0210.260] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x254) returned 0x0 [0210.260] RegQueryValueExW (in: hKey=0x254, lpValueName="SMTP Password", lpReserved=0x0, lpType=0x559ed30, lpData=0x0, lpcbData=0x559ed2c*=0x0 | out: lpType=0x559ed30*=0x0, lpData=0x0, lpcbData=0x559ed2c*=0x0) returned 0x2 [0210.260] RegCloseKey (hKey=0x254) returned 0x0 [0210.261] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed3c | out: phkResult=0x559ed3c*=0x254) returned 0x0 [0210.261] RegQueryInfoKeyW (in: hKey=0x254, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x559ed60, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x559ed5c, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x559ed60*=0x4, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x559ed5c*=0x5, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0210.261] RegEnumKeyExW (in: hKey=0x254, dwIndex=0x0, lpName=0x2480144, lpcchName=0x559ed7c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00000001", lpcchName=0x559ed7c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0210.261] CoTaskMemFree (pv=0x0) [0210.261] RegEnumKeyExW (in: hKey=0x254, dwIndex=0x1, lpName=0x2480144, lpcchName=0x559ed7c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00000002", lpcchName=0x559ed7c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0210.261] CoTaskMemFree (pv=0x0) [0210.261] RegEnumKeyExW (in: hKey=0x254, dwIndex=0x2, lpName=0x2480144, lpcchName=0x559ed7c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00000003", lpcchName=0x559ed7c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0210.261] CoTaskMemFree (pv=0x0) [0210.261] RegEnumKeyExW (in: hKey=0x254, dwIndex=0x3, lpName=0x2480144, lpcchName=0x559ed7c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00000004", lpcchName=0x559ed7c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0210.262] CoTaskMemFree (pv=0x0) [0210.262] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x380) returned 0x0 [0210.262] RegQueryValueExW (in: hKey=0x380, lpValueName="SMTP Email Address", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.262] RegCloseKey (hKey=0x380) returned 0x0 [0210.263] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x380) returned 0x0 [0210.263] RegQueryValueExW (in: hKey=0x380, lpValueName="SMTP Server", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.263] RegCloseKey (hKey=0x380) returned 0x0 [0210.263] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x380) returned 0x0 [0210.264] RegQueryValueExW (in: hKey=0x380, lpValueName="POP3 Server", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.264] RegCloseKey (hKey=0x380) returned 0x0 [0210.264] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x380) returned 0x0 [0210.264] RegQueryValueExW (in: hKey=0x380, lpValueName="POP3 User Name", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.264] RegCloseKey (hKey=0x380) returned 0x0 [0210.265] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x380) returned 0x0 [0210.265] RegQueryValueExW (in: hKey=0x380, lpValueName="SMTP User Name", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.265] RegCloseKey (hKey=0x380) returned 0x0 [0210.266] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x380) returned 0x0 [0210.266] RegQueryValueExW (in: hKey=0x380, lpValueName="NNTP Email Address", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.266] RegCloseKey (hKey=0x380) returned 0x0 [0210.267] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x380) returned 0x0 [0210.267] RegQueryValueExW (in: hKey=0x380, lpValueName="NNTP User Name", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.267] RegCloseKey (hKey=0x380) returned 0x0 [0210.267] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x380) returned 0x0 [0210.268] RegQueryValueExW (in: hKey=0x380, lpValueName="NNTP Server", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.268] RegCloseKey (hKey=0x380) returned 0x0 [0210.268] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x380) returned 0x0 [0210.268] RegQueryValueExW (in: hKey=0x380, lpValueName="IMAP Server", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.268] RegCloseKey (hKey=0x380) returned 0x0 [0210.269] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x380) returned 0x0 [0210.269] RegQueryValueExW (in: hKey=0x380, lpValueName="IMAP User Name", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.269] RegCloseKey (hKey=0x380) returned 0x0 [0210.270] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x380) returned 0x0 [0210.270] RegQueryValueExW (in: hKey=0x380, lpValueName="Email", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.270] RegCloseKey (hKey=0x380) returned 0x0 [0210.271] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x380) returned 0x0 [0210.271] RegQueryValueExW (in: hKey=0x380, lpValueName="HTTP User", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.271] RegCloseKey (hKey=0x380) returned 0x0 [0210.371] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x380) returned 0x0 [0210.371] RegQueryValueExW (in: hKey=0x380, lpValueName="HTTP Server URL", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.371] RegCloseKey (hKey=0x380) returned 0x0 [0210.372] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x380) returned 0x0 [0210.372] RegQueryValueExW (in: hKey=0x380, lpValueName="POP3 User", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.372] RegCloseKey (hKey=0x380) returned 0x0 [0210.374] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x380) returned 0x0 [0210.374] RegQueryValueExW (in: hKey=0x380, lpValueName="IMAP User", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.374] RegCloseKey (hKey=0x380) returned 0x0 [0210.375] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x380) returned 0x0 [0210.375] RegQueryValueExW (in: hKey=0x380, lpValueName="HTTPMail User Name", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.375] RegCloseKey (hKey=0x380) returned 0x0 [0210.375] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x380) returned 0x0 [0210.375] RegQueryValueExW (in: hKey=0x380, lpValueName="HTTPMail Server", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.376] RegCloseKey (hKey=0x380) returned 0x0 [0210.376] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x380) returned 0x0 [0210.376] RegQueryValueExW (in: hKey=0x380, lpValueName="SMTP User", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.377] RegCloseKey (hKey=0x380) returned 0x0 [0210.377] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x380) returned 0x0 [0210.377] RegQueryValueExW (in: hKey=0x380, lpValueName="POP3 Password2", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.377] RegCloseKey (hKey=0x380) returned 0x0 [0210.378] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x380) returned 0x0 [0210.378] RegQueryValueExW (in: hKey=0x380, lpValueName="IMAP Password2", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.378] RegCloseKey (hKey=0x380) returned 0x0 [0210.379] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x380) returned 0x0 [0210.379] RegQueryValueExW (in: hKey=0x380, lpValueName="NNTP Password2", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.379] RegCloseKey (hKey=0x380) returned 0x0 [0210.380] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x380) returned 0x0 [0210.380] RegQueryValueExW (in: hKey=0x380, lpValueName="HTTPMail Password2", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.380] RegCloseKey (hKey=0x380) returned 0x0 [0210.381] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x380) returned 0x0 [0210.381] RegQueryValueExW (in: hKey=0x380, lpValueName="SMTP Password2", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.381] RegCloseKey (hKey=0x380) returned 0x0 [0210.382] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x380) returned 0x0 [0210.382] RegQueryValueExW (in: hKey=0x380, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.382] RegCloseKey (hKey=0x380) returned 0x0 [0210.383] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x380) returned 0x0 [0210.383] RegQueryValueExW (in: hKey=0x380, lpValueName="IMAP Password", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.383] RegCloseKey (hKey=0x380) returned 0x0 [0210.384] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x380) returned 0x0 [0210.384] RegQueryValueExW (in: hKey=0x380, lpValueName="NNTP Password", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.384] RegCloseKey (hKey=0x380) returned 0x0 [0210.385] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x380) returned 0x0 [0210.385] RegQueryValueExW (in: hKey=0x380, lpValueName="HTTPMail Password", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.385] RegCloseKey (hKey=0x380) returned 0x0 [0210.386] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x380) returned 0x0 [0210.386] RegQueryValueExW (in: hKey=0x380, lpValueName="SMTP Password", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.386] RegCloseKey (hKey=0x380) returned 0x0 [0210.387] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ecf4 | out: phkResult=0x559ecf4*=0x380) returned 0x0 [0210.387] RegQueryInfoKeyW (in: hKey=0x380, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x559ed18, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x559ed14, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x559ed18*=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x559ed14*=0x7, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0210.387] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x298) returned 0x0 [0210.387] RegQueryValueExW (in: hKey=0x298, lpValueName="SMTP Email Address", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.387] RegCloseKey (hKey=0x298) returned 0x0 [0210.388] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x298) returned 0x0 [0210.388] RegQueryValueExW (in: hKey=0x298, lpValueName="SMTP Server", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.388] RegCloseKey (hKey=0x298) returned 0x0 [0210.389] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x298) returned 0x0 [0210.389] RegQueryValueExW (in: hKey=0x298, lpValueName="POP3 Server", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.389] RegCloseKey (hKey=0x298) returned 0x0 [0210.390] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x298) returned 0x0 [0210.390] RegQueryValueExW (in: hKey=0x298, lpValueName="POP3 User Name", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.390] RegCloseKey (hKey=0x298) returned 0x0 [0210.391] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x298) returned 0x0 [0210.391] RegQueryValueExW (in: hKey=0x298, lpValueName="SMTP User Name", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.391] RegCloseKey (hKey=0x298) returned 0x0 [0210.392] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x298) returned 0x0 [0210.392] RegQueryValueExW (in: hKey=0x298, lpValueName="NNTP Email Address", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.392] RegCloseKey (hKey=0x298) returned 0x0 [0210.393] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x298) returned 0x0 [0210.393] RegQueryValueExW (in: hKey=0x298, lpValueName="NNTP User Name", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.393] RegCloseKey (hKey=0x298) returned 0x0 [0210.394] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x298) returned 0x0 [0210.394] RegQueryValueExW (in: hKey=0x298, lpValueName="NNTP Server", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.394] RegCloseKey (hKey=0x298) returned 0x0 [0210.395] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x298) returned 0x0 [0210.395] RegQueryValueExW (in: hKey=0x298, lpValueName="IMAP Server", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.395] RegCloseKey (hKey=0x298) returned 0x0 [0210.395] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x298) returned 0x0 [0210.396] RegQueryValueExW (in: hKey=0x298, lpValueName="IMAP User Name", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.396] RegCloseKey (hKey=0x298) returned 0x0 [0210.398] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x298) returned 0x0 [0210.398] RegQueryValueExW (in: hKey=0x298, lpValueName="Email", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.398] RegCloseKey (hKey=0x298) returned 0x0 [0210.399] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x298) returned 0x0 [0210.399] RegQueryValueExW (in: hKey=0x298, lpValueName="HTTP User", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.399] RegCloseKey (hKey=0x298) returned 0x0 [0210.400] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x298) returned 0x0 [0210.400] RegQueryValueExW (in: hKey=0x298, lpValueName="HTTP Server URL", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.400] RegCloseKey (hKey=0x298) returned 0x0 [0210.401] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x298) returned 0x0 [0210.401] RegQueryValueExW (in: hKey=0x298, lpValueName="POP3 User", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.401] RegCloseKey (hKey=0x298) returned 0x0 [0210.402] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x298) returned 0x0 [0210.402] RegQueryValueExW (in: hKey=0x298, lpValueName="IMAP User", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.402] RegCloseKey (hKey=0x298) returned 0x0 [0210.402] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x298) returned 0x0 [0210.403] RegQueryValueExW (in: hKey=0x298, lpValueName="HTTPMail User Name", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.403] RegCloseKey (hKey=0x298) returned 0x0 [0210.403] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x298) returned 0x0 [0210.403] RegQueryValueExW (in: hKey=0x298, lpValueName="HTTPMail Server", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.403] RegCloseKey (hKey=0x298) returned 0x0 [0210.404] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x298) returned 0x0 [0210.404] RegQueryValueExW (in: hKey=0x298, lpValueName="SMTP User", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.404] RegCloseKey (hKey=0x298) returned 0x0 [0210.405] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x298) returned 0x0 [0210.405] RegQueryValueExW (in: hKey=0x298, lpValueName="POP3 Password2", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.406] RegCloseKey (hKey=0x298) returned 0x0 [0210.406] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x298) returned 0x0 [0210.406] RegQueryValueExW (in: hKey=0x298, lpValueName="IMAP Password2", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.406] RegCloseKey (hKey=0x298) returned 0x0 [0210.407] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x298) returned 0x0 [0210.407] RegQueryValueExW (in: hKey=0x298, lpValueName="NNTP Password2", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.407] RegCloseKey (hKey=0x298) returned 0x0 [0210.408] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x298) returned 0x0 [0210.408] RegQueryValueExW (in: hKey=0x298, lpValueName="HTTPMail Password2", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.408] RegCloseKey (hKey=0x298) returned 0x0 [0210.409] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x298) returned 0x0 [0210.409] RegQueryValueExW (in: hKey=0x298, lpValueName="SMTP Password2", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.409] RegCloseKey (hKey=0x298) returned 0x0 [0210.410] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x298) returned 0x0 [0210.410] RegQueryValueExW (in: hKey=0x298, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.410] RegCloseKey (hKey=0x298) returned 0x0 [0210.411] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x298) returned 0x0 [0210.411] RegQueryValueExW (in: hKey=0x298, lpValueName="IMAP Password", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.411] RegCloseKey (hKey=0x298) returned 0x0 [0210.412] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x298) returned 0x0 [0210.412] RegQueryValueExW (in: hKey=0x298, lpValueName="NNTP Password", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.412] RegCloseKey (hKey=0x298) returned 0x0 [0210.413] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x298) returned 0x0 [0210.413] RegQueryValueExW (in: hKey=0x298, lpValueName="HTTPMail Password", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.413] RegCloseKey (hKey=0x298) returned 0x0 [0210.414] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x298) returned 0x0 [0210.414] RegQueryValueExW (in: hKey=0x298, lpValueName="SMTP Password", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.414] RegCloseKey (hKey=0x298) returned 0x0 [0210.415] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ecf4 | out: phkResult=0x559ecf4*=0x298) returned 0x0 [0210.415] RegQueryInfoKeyW (in: hKey=0x298, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x559ed18, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x559ed14, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x559ed18*=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x559ed14*=0x7, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0210.415] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x294) returned 0x0 [0210.416] RegQueryValueExW (in: hKey=0x294, lpValueName="SMTP Email Address", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.416] RegCloseKey (hKey=0x294) returned 0x0 [0210.416] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x294) returned 0x0 [0210.417] RegQueryValueExW (in: hKey=0x294, lpValueName="SMTP Server", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x3, lpData=0x0, lpcbData=0x559ece4*=0xc) returned 0x0 [0210.417] RegQueryValueExW (in: hKey=0x294, lpValueName="SMTP Server", lpReserved=0x0, lpType=0x559ece8, lpData=0x2499690, lpcbData=0x559ece4*=0xc | out: lpType=0x559ece8*=0x3, lpData=0x2499690*, lpcbData=0x559ece4*=0xc) returned 0x0 [0210.417] RegCloseKey (hKey=0x294) returned 0x0 [0210.425] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x294) returned 0x0 [0210.425] RegQueryValueExW (in: hKey=0x294, lpValueName="POP3 Server", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x3, lpData=0x0, lpcbData=0x559ece4*=0xa) returned 0x0 [0210.425] RegQueryValueExW (in: hKey=0x294, lpValueName="POP3 Server", lpReserved=0x0, lpType=0x559ece8, lpData=0x249a61c, lpcbData=0x559ece4*=0xa | out: lpType=0x559ece8*=0x3, lpData=0x249a61c*, lpcbData=0x559ece4*=0xa) returned 0x0 [0210.425] RegCloseKey (hKey=0x294) returned 0x0 [0210.426] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x294) returned 0x0 [0210.426] RegQueryValueExW (in: hKey=0x294, lpValueName="POP3 User Name", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.426] RegCloseKey (hKey=0x294) returned 0x0 [0210.427] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x294) returned 0x0 [0210.427] RegQueryValueExW (in: hKey=0x294, lpValueName="SMTP User Name", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.427] RegCloseKey (hKey=0x294) returned 0x0 [0210.428] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x294) returned 0x0 [0210.428] RegQueryValueExW (in: hKey=0x294, lpValueName="NNTP Email Address", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.428] RegCloseKey (hKey=0x294) returned 0x0 [0210.429] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x294) returned 0x0 [0210.429] RegQueryValueExW (in: hKey=0x294, lpValueName="NNTP User Name", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.429] RegCloseKey (hKey=0x294) returned 0x0 [0210.430] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x294) returned 0x0 [0210.430] RegQueryValueExW (in: hKey=0x294, lpValueName="NNTP Server", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.430] RegCloseKey (hKey=0x294) returned 0x0 [0210.431] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x294) returned 0x0 [0210.431] RegQueryValueExW (in: hKey=0x294, lpValueName="IMAP Server", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.431] RegCloseKey (hKey=0x294) returned 0x0 [0210.432] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x294) returned 0x0 [0210.432] RegQueryValueExW (in: hKey=0x294, lpValueName="IMAP User Name", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.432] RegCloseKey (hKey=0x294) returned 0x0 [0210.433] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x294) returned 0x0 [0210.433] RegQueryValueExW (in: hKey=0x294, lpValueName="Email", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x3, lpData=0x0, lpcbData=0x559ece4*=0x26) returned 0x0 [0210.433] RegQueryValueExW (in: hKey=0x294, lpValueName="Email", lpReserved=0x0, lpType=0x559ece8, lpData=0x249cb4c, lpcbData=0x559ece4*=0x26 | out: lpType=0x559ece8*=0x3, lpData=0x249cb4c*, lpcbData=0x559ece4*=0x26) returned 0x0 [0210.433] RegCloseKey (hKey=0x294) returned 0x0 [0210.434] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x294) returned 0x0 [0210.434] RegQueryValueExW (in: hKey=0x294, lpValueName="HTTP User", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.434] RegCloseKey (hKey=0x294) returned 0x0 [0210.434] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x294) returned 0x0 [0210.435] RegQueryValueExW (in: hKey=0x294, lpValueName="HTTP Server URL", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.435] RegCloseKey (hKey=0x294) returned 0x0 [0210.435] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x294) returned 0x0 [0210.435] RegQueryValueExW (in: hKey=0x294, lpValueName="POP3 User", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x3, lpData=0x0, lpcbData=0x559ece4*=0xe) returned 0x0 [0210.436] RegQueryValueExW (in: hKey=0x294, lpValueName="POP3 User", lpReserved=0x0, lpType=0x559ece8, lpData=0x249d9f0, lpcbData=0x559ece4*=0xe | out: lpType=0x559ece8*=0x3, lpData=0x249d9f0*, lpcbData=0x559ece4*=0xe) returned 0x0 [0210.436] RegCloseKey (hKey=0x294) returned 0x0 [0210.436] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x294) returned 0x0 [0210.436] RegQueryValueExW (in: hKey=0x294, lpValueName="IMAP User", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.436] RegCloseKey (hKey=0x294) returned 0x0 [0210.437] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x294) returned 0x0 [0210.437] RegQueryValueExW (in: hKey=0x294, lpValueName="HTTPMail User Name", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.437] RegCloseKey (hKey=0x294) returned 0x0 [0210.438] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x294) returned 0x0 [0210.438] RegQueryValueExW (in: hKey=0x294, lpValueName="HTTPMail Server", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.438] RegCloseKey (hKey=0x294) returned 0x0 [0210.438] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x294) returned 0x0 [0210.439] RegQueryValueExW (in: hKey=0x294, lpValueName="SMTP User", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.439] RegCloseKey (hKey=0x294) returned 0x0 [0210.439] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x294) returned 0x0 [0210.439] RegQueryValueExW (in: hKey=0x294, lpValueName="POP3 Password2", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.439] RegCloseKey (hKey=0x294) returned 0x0 [0210.440] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x294) returned 0x0 [0210.440] RegQueryValueExW (in: hKey=0x294, lpValueName="IMAP Password2", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.440] RegCloseKey (hKey=0x294) returned 0x0 [0210.441] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x294) returned 0x0 [0210.441] RegQueryValueExW (in: hKey=0x294, lpValueName="NNTP Password2", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.441] RegCloseKey (hKey=0x294) returned 0x0 [0210.442] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x294) returned 0x0 [0210.442] RegQueryValueExW (in: hKey=0x294, lpValueName="HTTPMail Password2", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.442] RegCloseKey (hKey=0x294) returned 0x0 [0210.442] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x294) returned 0x0 [0210.443] RegQueryValueExW (in: hKey=0x294, lpValueName="SMTP Password2", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.444] RegCloseKey (hKey=0x294) returned 0x0 [0210.445] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x294) returned 0x0 [0210.445] RegQueryValueExW (in: hKey=0x294, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x3, lpData=0x0, lpcbData=0x559ece4*=0x131) returned 0x0 [0210.445] RegQueryValueExW (in: hKey=0x294, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x559ece8, lpData=0x24a08d4, lpcbData=0x559ece4*=0x131 | out: lpType=0x559ece8*=0x3, lpData=0x24a08d4*, lpcbData=0x559ece4*=0x131) returned 0x0 [0210.445] RegCloseKey (hKey=0x294) returned 0x0 [0210.451] CryptUnprotectData (in: pDataIn=0x559ecec, ppszDataDescr=0x0, pOptionalEntropy=0x559ece4, pvReserved=0x0, pPromptStruct=0x0, dwFlags=0x1, pDataOut=0x559ecf4 | out: ppszDataDescr=0x0, pDataOut=0x559ecf4) returned 1 [0210.506] LocalFree (hMem=0x9ca278) returned 0x0 [0210.507] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x2a0) returned 0x0 [0210.507] RegQueryValueExW (in: hKey=0x2a0, lpValueName="IMAP Password", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.507] RegCloseKey (hKey=0x2a0) returned 0x0 [0210.508] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x2a0) returned 0x0 [0210.508] RegQueryValueExW (in: hKey=0x2a0, lpValueName="NNTP Password", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.508] RegCloseKey (hKey=0x2a0) returned 0x0 [0210.509] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x2a0) returned 0x0 [0210.509] RegQueryValueExW (in: hKey=0x2a0, lpValueName="HTTPMail Password", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.509] RegCloseKey (hKey=0x2a0) returned 0x0 [0210.510] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x2a0) returned 0x0 [0210.510] RegQueryValueExW (in: hKey=0x2a0, lpValueName="SMTP Password", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.510] RegCloseKey (hKey=0x2a0) returned 0x0 [0210.510] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ecf4 | out: phkResult=0x559ecf4*=0x2a0) returned 0x0 [0210.510] RegQueryInfoKeyW (in: hKey=0x2a0, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x559ed18, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x559ed14, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x559ed18*=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x559ed14*=0xe, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0210.511] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000004", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x2a4) returned 0x0 [0210.511] RegQueryValueExW (in: hKey=0x2a4, lpValueName="SMTP Email Address", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.511] RegCloseKey (hKey=0x2a4) returned 0x0 [0210.512] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000004", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x2a4) returned 0x0 [0210.512] RegQueryValueExW (in: hKey=0x2a4, lpValueName="SMTP Server", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.512] RegCloseKey (hKey=0x2a4) returned 0x0 [0210.512] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000004", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x2a4) returned 0x0 [0210.512] RegQueryValueExW (in: hKey=0x2a4, lpValueName="POP3 Server", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.513] RegCloseKey (hKey=0x2a4) returned 0x0 [0210.513] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000004", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x2a4) returned 0x0 [0210.513] RegQueryValueExW (in: hKey=0x2a4, lpValueName="POP3 User Name", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.513] RegCloseKey (hKey=0x2a4) returned 0x0 [0210.514] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000004", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x2a4) returned 0x0 [0210.514] RegQueryValueExW (in: hKey=0x2a4, lpValueName="SMTP User Name", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.514] RegCloseKey (hKey=0x2a4) returned 0x0 [0210.515] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000004", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x2a4) returned 0x0 [0210.515] RegQueryValueExW (in: hKey=0x2a4, lpValueName="NNTP Email Address", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.515] RegCloseKey (hKey=0x2a4) returned 0x0 [0210.516] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000004", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x2a4) returned 0x0 [0210.516] RegQueryValueExW (in: hKey=0x2a4, lpValueName="NNTP User Name", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.516] RegCloseKey (hKey=0x2a4) returned 0x0 [0210.516] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000004", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x2a4) returned 0x0 [0210.517] RegQueryValueExW (in: hKey=0x2a4, lpValueName="NNTP Server", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.517] RegCloseKey (hKey=0x2a4) returned 0x0 [0210.517] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000004", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x2a4) returned 0x0 [0210.517] RegQueryValueExW (in: hKey=0x2a4, lpValueName="IMAP Server", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.517] RegCloseKey (hKey=0x2a4) returned 0x0 [0210.518] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000004", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x2a4) returned 0x0 [0210.518] RegQueryValueExW (in: hKey=0x2a4, lpValueName="IMAP User Name", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.518] RegCloseKey (hKey=0x2a4) returned 0x0 [0210.519] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000004", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x2a4) returned 0x0 [0210.519] RegQueryValueExW (in: hKey=0x2a4, lpValueName="Email", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.519] RegCloseKey (hKey=0x2a4) returned 0x0 [0210.520] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000004", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x2a4) returned 0x0 [0210.520] RegQueryValueExW (in: hKey=0x2a4, lpValueName="HTTP User", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.520] RegCloseKey (hKey=0x2a4) returned 0x0 [0210.520] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000004", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x2a4) returned 0x0 [0210.521] RegQueryValueExW (in: hKey=0x2a4, lpValueName="HTTP Server URL", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.521] RegCloseKey (hKey=0x2a4) returned 0x0 [0210.521] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000004", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x2a4) returned 0x0 [0210.522] RegQueryValueExW (in: hKey=0x2a4, lpValueName="POP3 User", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.522] RegCloseKey (hKey=0x2a4) returned 0x0 [0210.522] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000004", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x2a4) returned 0x0 [0210.522] RegQueryValueExW (in: hKey=0x2a4, lpValueName="IMAP User", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.522] RegCloseKey (hKey=0x2a4) returned 0x0 [0210.523] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000004", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x2a4) returned 0x0 [0210.523] RegQueryValueExW (in: hKey=0x2a4, lpValueName="HTTPMail User Name", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.523] RegCloseKey (hKey=0x2a4) returned 0x0 [0210.524] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000004", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x2a4) returned 0x0 [0210.524] RegQueryValueExW (in: hKey=0x2a4, lpValueName="HTTPMail Server", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.524] RegCloseKey (hKey=0x2a4) returned 0x0 [0210.525] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000004", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x2a4) returned 0x0 [0210.525] RegQueryValueExW (in: hKey=0x2a4, lpValueName="SMTP User", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.525] RegCloseKey (hKey=0x2a4) returned 0x0 [0210.526] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000004", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x2a4) returned 0x0 [0210.526] RegQueryValueExW (in: hKey=0x2a4, lpValueName="POP3 Password2", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.527] RegCloseKey (hKey=0x2a4) returned 0x0 [0210.527] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000004", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x2a4) returned 0x0 [0210.528] RegQueryValueExW (in: hKey=0x2a4, lpValueName="IMAP Password2", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.528] RegCloseKey (hKey=0x2a4) returned 0x0 [0210.528] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000004", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x2a4) returned 0x0 [0210.528] RegQueryValueExW (in: hKey=0x2a4, lpValueName="NNTP Password2", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.528] RegCloseKey (hKey=0x2a4) returned 0x0 [0210.529] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000004", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x2a4) returned 0x0 [0210.529] RegQueryValueExW (in: hKey=0x2a4, lpValueName="HTTPMail Password2", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.529] RegCloseKey (hKey=0x2a4) returned 0x0 [0210.530] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000004", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x2a4) returned 0x0 [0210.530] RegQueryValueExW (in: hKey=0x2a4, lpValueName="SMTP Password2", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.530] RegCloseKey (hKey=0x2a4) returned 0x0 [0210.531] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000004", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x2a4) returned 0x0 [0210.531] RegQueryValueExW (in: hKey=0x2a4, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.531] RegCloseKey (hKey=0x2a4) returned 0x0 [0210.532] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000004", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x2a4) returned 0x0 [0210.532] RegQueryValueExW (in: hKey=0x2a4, lpValueName="IMAP Password", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.532] RegCloseKey (hKey=0x2a4) returned 0x0 [0210.533] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000004", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x2a4) returned 0x0 [0210.533] RegQueryValueExW (in: hKey=0x2a4, lpValueName="NNTP Password", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.533] RegCloseKey (hKey=0x2a4) returned 0x0 [0210.534] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000004", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x2a4) returned 0x0 [0210.534] RegQueryValueExW (in: hKey=0x2a4, lpValueName="HTTPMail Password", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.534] RegCloseKey (hKey=0x2a4) returned 0x0 [0210.534] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000004", ulOptions=0x0, samDesired=0x20019, phkResult=0x559eccc | out: phkResult=0x559eccc*=0x2a4) returned 0x0 [0210.535] RegQueryValueExW (in: hKey=0x2a4, lpValueName="SMTP Password", lpReserved=0x0, lpType=0x559ece8, lpData=0x0, lpcbData=0x559ece4*=0x0 | out: lpType=0x559ece8*=0x0, lpData=0x0, lpcbData=0x559ece4*=0x0) returned 0x2 [0210.535] RegCloseKey (hKey=0x2a4) returned 0x0 [0210.535] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000004", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ecf4 | out: phkResult=0x559ecf4*=0x2a4) returned 0x0 [0210.535] RegQueryInfoKeyW (in: hKey=0x2a4, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x559ed18, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x559ed14, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x559ed18*=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x559ed14*=0x7, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0210.536] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.538] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.539] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.540] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.541] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.542] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.543] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.544] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.545] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.546] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.547] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.548] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.549] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.550] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.551] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.552] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.553] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.554] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.555] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.556] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.557] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.558] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.559] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.560] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.561] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.562] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.563] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.564] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed14 | out: phkResult=0x559ed14*=0x0) returned 0x2 [0210.565] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed3c | out: phkResult=0x559ed3c*=0x0) returned 0x2 [0210.565] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x559e734, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0210.566] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Others.txt", nBufferLength=0x105, lpBuffer=0x559e748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Others.txt", lpFilePart=0x0) returned 0x7d [0210.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec3c) returned 1 [0210.566] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Others.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\others.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2a8 [0210.569] GetFileType (hFile=0x2a8) returned 0x1 [0210.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x559ec38) returned 1 [0210.569] GetFileType (hFile=0x2a8) returned 0x1 [0210.569] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x559ec10*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x559ec10*=0) returned 0x0 [0210.569] WriteFile (in: hFile=0x2a8, lpBuffer=0x24b7a84*, nNumberOfBytesToWrite=0x8a, lpNumberOfBytesWritten=0x559ece4, lpOverlapped=0x0 | out: lpBuffer=0x24b7a84*, lpNumberOfBytesWritten=0x559ece4*=0x8a, lpOverlapped=0x0) returned 1 [0210.570] CloseHandle (hObject=0x2a8) returned 1 [0210.571] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x559e764, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0210.571] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Others.txt", nBufferLength=0x105, lpBuffer=0x559e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Others.txt", lpFilePart=0x0) returned 0x7d [0210.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec6c) returned 1 [0210.571] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Others.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\others.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2a8 [0210.571] GetFileType (hFile=0x2a8) returned 0x1 [0210.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x559ec68) returned 1 [0210.572] GetFileType (hFile=0x2a8) returned 0x1 [0210.572] SetFilePointer (in: hFile=0x2a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x559ec40*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x559ec40*=0) returned 0x8a [0210.572] WriteFile (in: hFile=0x2a8, lpBuffer=0x24ba1a4*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x559ed14, lpOverlapped=0x0 | out: lpBuffer=0x24ba1a4*, lpNumberOfBytesWritten=0x559ed14*=0x2, lpOverlapped=0x0) returned 1 [0210.572] CloseHandle (hObject=0x2a8) returned 1 [0210.866] GetLogicalDrives () returned 0x4 [0210.866] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x559e7ec, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0210.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ed00) returned 1 [0210.867] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x559ed7c | out: lpFileInformation=0x559ed7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0xe0adbcc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe0adbcc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0210.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x559ecfc) returned 1 [0210.867] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x559e87c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0210.875] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x2a8 [0210.880] CoGetObjectContext (in: riid=0x24bbd70*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x559ed34 | out: ppv=0x559ed34*=0x98faac) returned 0x0 [0211.062] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x559dfc8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0211.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll", cchWideChar=63, lpMultiByteStr=0x559e4c8, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll", lpUsedDefaultChar=0x0) returned 63 [0211.064] LoadLibraryA (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll") returned 0x6ed40000 [0211.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ResetSecurity", cchWideChar=13, lpMultiByteStr=0x559e4fc, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ResetSecurity\x1a\x05s\x0b9­\x1a\x94ÂOt¼çY\x05x\x9b\x9a", lpUsedDefaultChar=0x0) returned 13 [0211.076] GetProcAddress (hModule=0x6ed40000, lpProcName="ResetSecurity") returned 0x6ed424de [0211.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SetSecurity", cchWideChar=11, lpMultiByteStr=0x559e4fc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SetSecurity", lpUsedDefaultChar=0x0) returned 11 [0211.084] GetProcAddress (hModule=0x6ed40000, lpProcName="SetSecurity") returned 0x6ed42520 [0211.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServices", cchWideChar=18, lpMultiByteStr=0x559e4f8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServices\x05s\x0b9­\x1a\x94ÂOt¼çY\x05", lpUsedDefaultChar=0x0) returned 18 [0211.092] GetProcAddress (hModule=0x6ed40000, lpProcName="BlessIWbemServices") returned 0x6ed41c69 [0211.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServicesObject", cchWideChar=24, lpMultiByteStr=0x559e4f0, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServicesObjectD\x1a\x05s\x0b9­\x1a\x94ÂOt¼çY\x05", lpUsedDefaultChar=0x0) returned 24 [0211.118] GetProcAddress (hModule=0x6ed40000, lpProcName="BlessIWbemServicesObject") returned 0x6ed41cbb [0211.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyHandle", cchWideChar=17, lpMultiByteStr=0x559e4f8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyHandle\x1a\x05s\x0b9­\x1a\x94ÂOt¼çY\x05", lpUsedDefaultChar=0x0) returned 17 [0211.140] GetProcAddress (hModule=0x6ed40000, lpProcName="GetPropertyHandle") returned 0x6ed421b4 [0211.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WritePropertyValue", cchWideChar=18, lpMultiByteStr=0x559e4f8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WritePropertyValue\x05s\x0b9­\x1a\x94ÂOt¼çY\x05", lpUsedDefaultChar=0x0) returned 18 [0211.154] GetProcAddress (hModule=0x6ed40000, lpProcName="WritePropertyValue") returned 0x6ed42617 [0211.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x559e504, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clone\x1a\x05s\x0b9­\x1a\x94ÂOt¼çY\x05", lpUsedDefaultChar=0x0) returned 5 [0211.165] GetProcAddress (hModule=0x6ed40000, lpProcName="Clone") returned 0x6ed41d0d [0211.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VerifyClientKey", cchWideChar=15, lpMultiByteStr=0x559e4f8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VerifyClientKey", lpUsedDefaultChar=0x0) returned 15 [0211.173] GetProcAddress (hModule=0x6ed40000, lpProcName="VerifyClientKey") returned 0x6ed425b4 [0211.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetQualifierSet", cchWideChar=15, lpMultiByteStr=0x559e4f8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetQualifierSet", lpUsedDefaultChar=0x0) returned 15 [0211.177] GetProcAddress (hModule=0x6ed40000, lpProcName="GetQualifierSet") returned 0x6ed42215 [0211.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Get", cchWideChar=3, lpMultiByteStr=0x559e504, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Get", lpUsedDefaultChar=0x0) returned 3 [0211.179] GetProcAddress (hModule=0x6ed40000, lpProcName="Get") returned 0x6ed420d4 [0211.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Put", cchWideChar=3, lpMultiByteStr=0x559e504, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Put", lpUsedDefaultChar=0x0) returned 3 [0211.196] GetProcAddress (hModule=0x6ed40000, lpProcName="Put") returned 0x6ed422be [0211.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Delete", cchWideChar=6, lpMultiByteStr=0x559e504, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Delete\x05s\x0b9­\x1a\x94ÂOt¼çY\x05", lpUsedDefaultChar=0x0) returned 6 [0211.211] GetProcAddress (hModule=0x6ed40000, lpProcName="Delete") returned 0x6ed41f31 [0211.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetNames", cchWideChar=8, lpMultiByteStr=0x559e500, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetNamesD\x1a\x05s\x0b9­\x1a\x94ÂOt¼çY\x05", lpUsedDefaultChar=0x0) returned 8 [0211.221] GetProcAddress (hModule=0x6ed40000, lpProcName="GetNames") returned 0x6ed42182 [0211.328] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeginEnumeration", cchWideChar=16, lpMultiByteStr=0x559e4f8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeginEnumerationD\x1a\x05s\x0b9­\x1a\x94ÂOt¼çY\x05", lpUsedDefaultChar=0x0) returned 16 [0211.328] GetProcAddress (hModule=0x6ed40000, lpProcName="BeginEnumeration") returned 0x6ed41c43 [0211.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Next", cchWideChar=4, lpMultiByteStr=0x559e504, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NextD\x1a\x05s\x0b9­\x1a\x94ÂOt¼çY\x05", lpUsedDefaultChar=0x0) returned 4 [0211.336] GetProcAddress (hModule=0x6ed40000, lpProcName="Next") returned 0x6ed42283 [0211.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EndEnumeration", cchWideChar=14, lpMultiByteStr=0x559e4fc, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EndEnumeration\x05s\x0b9­\x1a\x94ÂOt¼çY\x05", lpUsedDefaultChar=0x0) returned 14 [0211.350] GetProcAddress (hModule=0x6ed40000, lpProcName="EndEnumeration") returned 0x6ed41fc2 [0211.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyQualifierSet", cchWideChar=23, lpMultiByteStr=0x559e4f0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyQualifierSet", lpUsedDefaultChar=0x0) returned 23 [0211.370] GetProcAddress (hModule=0x6ed40000, lpProcName="GetPropertyQualifierSet") returned 0x6ed421ff [0211.382] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x559e504, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clone\x1a\x05s\x0b9­\x1a\x94ÂOt¼çY\x05", lpUsedDefaultChar=0x0) returned 5 [0211.382] GetProcAddress (hModule=0x6ed40000, lpProcName="Clone") returned 0x6ed41d0d [0211.382] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetObjectText", cchWideChar=13, lpMultiByteStr=0x559e4fc, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetObjectText\x1a\x05s\x0b9­\x1a\x94ÂOt¼çY\x05", lpUsedDefaultChar=0x0) returned 13 [0211.382] GetProcAddress (hModule=0x6ed40000, lpProcName="GetObjectText") returned 0x6ed4219e [0211.395] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SpawnDerivedClass", cchWideChar=17, lpMultiByteStr=0x559e4f8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpawnDerivedClass\x1a\x05s\x0b9­\x1a\x94ÂOt¼çY\x05", lpUsedDefaultChar=0x0) returned 17 [0211.395] GetProcAddress (hModule=0x6ed40000, lpProcName="SpawnDerivedClass") returned 0x6ed42566 [0211.405] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SpawnInstance", cchWideChar=13, lpMultiByteStr=0x559e4fc, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpawnInstance\x1a\x05s\x0b9­\x1a\x94ÂOt¼çY\x05", lpUsedDefaultChar=0x0) returned 13 [0211.405] GetProcAddress (hModule=0x6ed40000, lpProcName="SpawnInstance") returned 0x6ed4257c [0211.406] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CompareTo", cchWideChar=9, lpMultiByteStr=0x559e500, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CompareTo\x1a\x05s\x0b9­\x1a\x94ÂOt¼çY\x05", lpUsedDefaultChar=0x0) returned 9 [0211.406] GetProcAddress (hModule=0x6ed40000, lpProcName="CompareTo") returned 0x6ed41d8d [0211.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyOrigin", cchWideChar=17, lpMultiByteStr=0x559e4f8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyOrigin\x1a\x05s\x0b9­\x1a\x94ÂOt¼çY\x05", lpUsedDefaultChar=0x0) returned 17 [0211.416] GetProcAddress (hModule=0x6ed40000, lpProcName="GetPropertyOrigin") returned 0x6ed421e9 [0211.428] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="InheritsFrom", cchWideChar=12, lpMultiByteStr=0x559e4fc, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InheritsFromD\x1a\x05s\x0b9­\x1a\x94ÂOt¼çY\x05", lpUsedDefaultChar=0x0) returned 12 [0211.428] GetProcAddress (hModule=0x6ed40000, lpProcName="InheritsFrom") returned 0x6ed42228 [0211.429] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethod", cchWideChar=9, lpMultiByteStr=0x559e500, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethod\x1a\x05s\x0b9­\x1a\x94ÂOt¼çY\x05", lpUsedDefaultChar=0x0) returned 9 [0211.429] GetProcAddress (hModule=0x6ed40000, lpProcName="GetMethod") returned 0x6ed4213a [0211.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutMethod", cchWideChar=9, lpMultiByteStr=0x559e500, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutMethod\x1a\x05s\x0b9­\x1a\x94ÂOt¼çY\x05", lpUsedDefaultChar=0x0) returned 9 [0211.442] GetProcAddress (hModule=0x6ed40000, lpProcName="PutMethod") returned 0x6ed423da [0211.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DeleteMethod", cchWideChar=12, lpMultiByteStr=0x559e4fc, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DeleteMethodD\x1a\x05s\x0b9­\x1a\x94ÂOt¼çY\x05", lpUsedDefaultChar=0x0) returned 12 [0211.454] GetProcAddress (hModule=0x6ed40000, lpProcName="DeleteMethod") returned 0x6ed41f44 [0211.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeginMethodEnumeration", cchWideChar=22, lpMultiByteStr=0x559e4f4, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeginMethodEnumeration\x05s\x0b9­\x1a\x94ÂOt¼çY\x05", lpUsedDefaultChar=0x0) returned 22 [0211.456] GetProcAddress (hModule=0x6ed40000, lpProcName="BeginMethodEnumeration") returned 0x6ed41c56 [0211.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NextMethod", cchWideChar=10, lpMultiByteStr=0x559e500, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NextMethod\x05s\x0b9­\x1a\x94ÂOt¼çY\x05", lpUsedDefaultChar=0x0) returned 10 [0211.458] GetProcAddress (hModule=0x6ed40000, lpProcName="NextMethod") returned 0x6ed422a2 [0211.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EndMethodEnumeration", cchWideChar=20, lpMultiByteStr=0x559e4f4, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EndMethodEnumerationD\x1a\x05s\x0b9­\x1a\x94ÂOt¼çY\x05", lpUsedDefaultChar=0x0) returned 20 [0211.474] GetProcAddress (hModule=0x6ed40000, lpProcName="EndMethodEnumeration") returned 0x6ed41fd2 [0211.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethodQualifierSet", cchWideChar=21, lpMultiByteStr=0x559e4f4, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodQualifierSet\x1a\x05s\x0b9­\x1a\x94ÂOt¼çY\x05", lpUsedDefaultChar=0x0) returned 21 [0211.475] GetProcAddress (hModule=0x6ed40000, lpProcName="GetMethodQualifierSet") returned 0x6ed4216c [0211.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethodOrigin", cchWideChar=15, lpMultiByteStr=0x559e4f8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodOrigin", lpUsedDefaultChar=0x0) returned 15 [0211.476] GetProcAddress (hModule=0x6ed40000, lpProcName="GetMethodOrigin") returned 0x6ed42156 [0211.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Get", cchWideChar=16, lpMultiByteStr=0x559e4f8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_GetD\x1a\x05s\x0b9­\x1a\x94ÂOt¼çY\x05", lpUsedDefaultChar=0x0) returned 16 [0211.477] GetProcAddress (hModule=0x6ed40000, lpProcName="QualifierSet_Get") returned 0x6ed4242c [0211.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Put", cchWideChar=16, lpMultiByteStr=0x559e4f8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_PutD\x1a\x05s\x0b9­\x1a\x94ÂOt¼çY\x05", lpUsedDefaultChar=0x0) returned 16 [0211.492] GetProcAddress (hModule=0x6ed40000, lpProcName="QualifierSet_Put") returned 0x6ed4247a [0211.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Delete", cchWideChar=19, lpMultiByteStr=0x559e4f4, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Delete", lpUsedDefaultChar=0x0) returned 19 [0211.508] GetProcAddress (hModule=0x6ed40000, lpProcName="QualifierSet_Delete") returned 0x6ed42409 [0211.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_GetNames", cchWideChar=21, lpMultiByteStr=0x559e4f4, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_GetNames\x1a\x05s\x0b9­\x1a\x94ÂOt¼çY\x05", lpUsedDefaultChar=0x0) returned 21 [0211.509] GetProcAddress (hModule=0x6ed40000, lpProcName="QualifierSet_GetNames") returned 0x6ed42448 [0211.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_BeginEnumeration", cchWideChar=29, lpMultiByteStr=0x559e4ec, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_BeginEnumeration\x1a\x05s\x0b9­\x1a\x94ÂOt¼çY\x05", lpUsedDefaultChar=0x0) returned 29 [0211.523] GetProcAddress (hModule=0x6ed40000, lpProcName="QualifierSet_BeginEnumeration") returned 0x6ed423f6 [0211.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Next", cchWideChar=17, lpMultiByteStr=0x559e4f8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Next\x1a\x05s\x0b9­\x1a\x94ÂOt¼çY\x05", lpUsedDefaultChar=0x0) returned 17 [0211.525] GetProcAddress (hModule=0x6ed40000, lpProcName="QualifierSet_Next") returned 0x6ed4245e [0211.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_EndEnumeration", cchWideChar=27, lpMultiByteStr=0x559e4ec, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_EndEnumeration", lpUsedDefaultChar=0x0) returned 27 [0211.547] GetProcAddress (hModule=0x6ed40000, lpProcName="QualifierSet_EndEnumeration") returned 0x6ed4241c [0211.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetCurrentApartmentType", cchWideChar=23, lpMultiByteStr=0x559e4f0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetCurrentApartmentType", lpUsedDefaultChar=0x0) returned 23 [0211.548] GetProcAddress (hModule=0x6ed40000, lpProcName="GetCurrentApartmentType") returned 0x6ed42215 [0211.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetDemultiplexedStub", cchWideChar=20, lpMultiByteStr=0x559e4f4, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetDemultiplexedStubD\x1a\x05s\x0b9­\x1a\x94ÂOt¼çY\x05", lpUsedDefaultChar=0x0) returned 20 [0211.557] GetProcAddress (hModule=0x6ed40000, lpProcName="GetDemultiplexedStub") returned 0x6ed420f3 [0211.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateInstanceEnumWmi", cchWideChar=21, lpMultiByteStr=0x559e4f4, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateInstanceEnumWmi\x1a\x05s\x0b9­\x1a\x94ÂOt¼çY\x05", lpUsedDefaultChar=0x0) returned 21 [0211.570] GetProcAddress (hModule=0x6ed40000, lpProcName="CreateInstanceEnumWmi") returned 0x6ed41ebb [0211.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateClassEnumWmi", cchWideChar=18, lpMultiByteStr=0x559e4f8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateClassEnumWmi\x05s\x0b9­\x1a\x94ÂOt¼çY\x05", lpUsedDefaultChar=0x0) returned 18 [0211.591] GetProcAddress (hModule=0x6ed40000, lpProcName="CreateClassEnumWmi") returned 0x6ed41e45 [0211.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ExecQueryWmi", cchWideChar=12, lpMultiByteStr=0x559e4fc, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExecQueryWmiD\x1a\x05s\x0b9­\x1a\x94ÂOt¼çY\x05", lpUsedDefaultChar=0x0) returned 12 [0211.593] GetProcAddress (hModule=0x6ed40000, lpProcName="ExecQueryWmi") returned 0x6ed4205b [0211.750] IComThreadingInfo:GetCurrentApartmentType (in: This=0x98faac, pAptType=0x559ed2c | out: pAptType=0x559ed2c*=1) returned 0x0 [0211.753] IUnknown:QueryInterface (in: This=0x98faac, riid=0x24bbd58*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x559ed30 | out: ppvObject=0x559ed30*=0x0) returned 0x80004002 [0211.753] IUnknown:Release (This=0x98faac) returned 0x0 [0211.767] IIDFromString (in: lpsz="{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}", lpiid=0x559e98c | out: lpiid=0x559e98c) returned 0x0 [0211.769] CoGetClassObject (in: rclsid=0xa2255c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7459d1fc*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x559e6a0 | out: ppv=0x559e6a0*=0x5fe0810) returned 0x0 [0211.784] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fe0810, riid=0x745d0ae0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x559e8b8 | out: ppvObject=0x559e8b8*=0x0) returned 0x80004002 [0211.784] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5fe0810, pUnkOuter=0x0, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e8cc | out: ppvObject=0x559e8cc*=0x5fe0820) returned 0x0 [0211.784] WbemDefPath:IUnknown:Release (This=0x5fe0810) returned 0x0 [0211.784] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fe0820, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e4ec | out: ppvObject=0x559e4ec*=0x5fe0820) returned 0x0 [0211.788] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fe0820, riid=0x7463fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x559e4a8 | out: ppvObject=0x559e4a8*=0x0) returned 0x80004002 [0211.789] WbemDefPath:IUnknown:AddRef (This=0x5fe0820) returned 0x3 [0211.789] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fe0820, riid=0x7463f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x559de04 | out: ppvObject=0x559de04*=0x0) returned 0x80004002 [0211.789] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fe0820, riid=0x7463f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x559ddb4 | out: ppvObject=0x559ddb4*=0x0) returned 0x80004002 [0211.789] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fe0820, riid=0x7462c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559ddc0 | out: ppvObject=0x559ddc0*=0xa0cc08) returned 0x0 [0211.789] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xa0cc08, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x559ddc8 | out: pCid=0x559ddc8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0211.789] WbemDefPath:IUnknown:Release (This=0xa0cc08) returned 0x3 [0211.789] CoGetContextToken (in: pToken=0x559de20 | out: pToken=0x559de20) returned 0x0 [0211.789] CoGetContextToken (in: pToken=0x559e228 | out: pToken=0x559e228) returned 0x0 [0211.789] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fe0820, riid=0x7463fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e2b8 | out: ppvObject=0x559e2b8*=0x0) returned 0x80004002 [0211.789] WbemDefPath:IUnknown:Release (This=0x5fe0820) returned 0x2 [0211.789] WbemDefPath:IUnknown:Release (This=0x5fe0820) returned 0x1 [0211.789] CoGetContextToken (in: pToken=0x559ebb0 | out: pToken=0x559ebb0) returned 0x0 [0211.789] CoGetContextToken (in: pToken=0x559eb10 | out: pToken=0x559eb10) returned 0x0 [0211.789] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fe0820, riid=0x559ebe0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x559ebdc | out: ppvObject=0x559ebdc*=0x5fe0820) returned 0x0 [0211.790] WbemDefPath:IUnknown:AddRef (This=0x5fe0820) returned 0x3 [0211.790] WbemDefPath:IUnknown:Release (This=0x5fe0820) returned 0x2 [0211.827] WbemDefPath:IWbemPath:SetText (This=0x5fe0820, uMode=0x4, pszPath="win32_logicaldisk.deviceid=\"C:\"") returned 0x0 [0211.828] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5fe0820, puCount=0x559ed60 | out: puCount=0x559ed60*=0x0) returned 0x0 [0211.828] WbemDefPath:IWbemPath:GetText (in: This=0x5fe0820, lFlags=2, puBuffLength=0x559ed5c*=0x0, pszText=0x0 | out: puBuffLength=0x559ed5c*=0x20, pszText=0x0) returned 0x0 [0211.829] WbemDefPath:IWbemPath:GetText (in: This=0x5fe0820, lFlags=2, puBuffLength=0x559ed5c*=0x20, pszText="0000000000000000000000000000000" | out: puBuffLength=0x559ed5c*=0x20, pszText="win32_logicaldisk.deviceid=\"C:\"") returned 0x0 [0211.830] WbemDefPath:IWbemPath:GetInfo (in: This=0x5fe0820, uRequestedInfo=0x0, puResponse=0x559ed68 | out: puResponse=0x559ed68*=0xc19) returned 0x0 [0211.830] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5fe0820, puCount=0x559ed60 | out: puCount=0x559ed60*=0x0) returned 0x0 [0211.830] WbemDefPath:IWbemPath:GetInfo (in: This=0x5fe0820, uRequestedInfo=0x0, puResponse=0x559ed68 | out: puResponse=0x559ed68*=0xc19) returned 0x0 [0211.830] WbemDefPath:IWbemPath:GetInfo (in: This=0x5fe0820, uRequestedInfo=0x0, puResponse=0x559ed68 | out: puResponse=0x559ed68*=0xc19) returned 0x0 [0211.830] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5fe0820, puCount=0x559ece0 | out: puCount=0x559ece0*=0x0) returned 0x0 [0211.849] CoGetObjectContext (in: riid=0x24bbd70*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x559e598 | out: ppv=0x559e598*=0x98faac) returned 0x0 [0211.849] IComThreadingInfo:GetCurrentApartmentType (in: This=0x98faac, pAptType=0x559e590 | out: pAptType=0x559e590*=1) returned 0x0 [0211.849] IUnknown:QueryInterface (in: This=0x98faac, riid=0x24bbd58*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x559e594 | out: ppvObject=0x559e594*=0x0) returned 0x80004002 [0211.849] IUnknown:Release (This=0x98faac) returned 0x0 [0211.850] CoGetClassObject (in: rclsid=0xa2255c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7459d1fc*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x559df00 | out: ppv=0x559df00*=0x5fe0900) returned 0x0 [0211.850] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fe0900, riid=0x745d0ae0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x559e118 | out: ppvObject=0x559e118*=0x0) returned 0x80004002 [0211.850] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5fe0900, pUnkOuter=0x0, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e12c | out: ppvObject=0x559e12c*=0x5fe09c0) returned 0x0 [0211.850] WbemDefPath:IUnknown:Release (This=0x5fe0900) returned 0x0 [0211.850] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fe09c0, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559dd4c | out: ppvObject=0x559dd4c*=0x5fe09c0) returned 0x0 [0211.850] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fe09c0, riid=0x7463fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x559dd08 | out: ppvObject=0x559dd08*=0x0) returned 0x80004002 [0211.850] WbemDefPath:IUnknown:AddRef (This=0x5fe09c0) returned 0x3 [0211.850] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fe09c0, riid=0x7463f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x559d664 | out: ppvObject=0x559d664*=0x0) returned 0x80004002 [0211.850] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fe09c0, riid=0x7463f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x559d614 | out: ppvObject=0x559d614*=0x0) returned 0x80004002 [0211.850] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fe09c0, riid=0x7462c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559d620 | out: ppvObject=0x559d620*=0xa0cc38) returned 0x0 [0211.850] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xa0cc38, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x559d628 | out: pCid=0x559d628*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0211.850] WbemDefPath:IUnknown:Release (This=0xa0cc38) returned 0x3 [0211.850] CoGetContextToken (in: pToken=0x559d680 | out: pToken=0x559d680) returned 0x0 [0211.851] CoGetContextToken (in: pToken=0x559da88 | out: pToken=0x559da88) returned 0x0 [0211.851] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fe09c0, riid=0x7463fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559db18 | out: ppvObject=0x559db18*=0x0) returned 0x80004002 [0211.851] WbemDefPath:IUnknown:Release (This=0x5fe09c0) returned 0x2 [0211.851] WbemDefPath:IUnknown:Release (This=0x5fe09c0) returned 0x1 [0211.851] CoGetContextToken (in: pToken=0x559e410 | out: pToken=0x559e410) returned 0x0 [0211.851] CoGetContextToken (in: pToken=0x559e370 | out: pToken=0x559e370) returned 0x0 [0211.851] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fe09c0, riid=0x559e440*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x559e43c | out: ppvObject=0x559e43c*=0x5fe09c0) returned 0x0 [0211.851] WbemDefPath:IUnknown:AddRef (This=0x5fe09c0) returned 0x3 [0211.851] WbemDefPath:IUnknown:Release (This=0x5fe09c0) returned 0x2 [0211.851] WbemDefPath:IWbemPath:SetText (This=0x5fe09c0, uMode=0x4, pszPath="//./root/cimv2") returned 0x0 [0211.851] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5fe09c0, puCount=0x559eccc | out: puCount=0x559eccc*=0x2) returned 0x0 [0211.851] WbemDefPath:IWbemPath:GetText (in: This=0x5fe09c0, lFlags=4, puBuffLength=0x559ecc8*=0x0, pszText=0x0 | out: puBuffLength=0x559ecc8*=0xf, pszText=0x0) returned 0x0 [0211.851] WbemDefPath:IWbemPath:GetText (in: This=0x5fe09c0, lFlags=4, puBuffLength=0x559ecc8*=0xf, pszText="00000000000000" | out: puBuffLength=0x559ecc8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0211.851] CoGetObjectContext (in: riid=0x24bbd70*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x559ec7c | out: ppv=0x559ec7c*=0x98faac) returned 0x0 [0211.851] IComThreadingInfo:GetCurrentApartmentType (in: This=0x98faac, pAptType=0x559ec74 | out: pAptType=0x559ec74*=1) returned 0x0 [0211.851] IUnknown:QueryInterface (in: This=0x98faac, riid=0x24bbd58*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x559ec78 | out: ppvObject=0x559ec78*=0x0) returned 0x80004002 [0211.851] IUnknown:Release (This=0x98faac) returned 0x0 [0211.852] CoGetClassObject (in: rclsid=0xa2255c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7459d1fc*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x559e5e8 | out: ppv=0x559e5e8*=0x5fe0910) returned 0x0 [0211.852] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fe0910, riid=0x745d0ae0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x559e800 | out: ppvObject=0x559e800*=0x0) returned 0x80004002 [0211.852] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5fe0910, pUnkOuter=0x0, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e814 | out: ppvObject=0x559e814*=0x5fe0ba0) returned 0x0 [0211.852] WbemDefPath:IUnknown:Release (This=0x5fe0910) returned 0x0 [0211.852] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fe0ba0, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e434 | out: ppvObject=0x559e434*=0x5fe0ba0) returned 0x0 [0211.852] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fe0ba0, riid=0x7463fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x559e3f0 | out: ppvObject=0x559e3f0*=0x0) returned 0x80004002 [0211.853] WbemDefPath:IUnknown:AddRef (This=0x5fe0ba0) returned 0x3 [0211.853] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fe0ba0, riid=0x7463f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x559dd4c | out: ppvObject=0x559dd4c*=0x0) returned 0x80004002 [0211.853] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fe0ba0, riid=0x7463f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x559dcfc | out: ppvObject=0x559dcfc*=0x0) returned 0x80004002 [0211.853] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fe0ba0, riid=0x7462c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559dd08 | out: ppvObject=0x559dd08*=0xa0cc68) returned 0x0 [0211.853] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xa0cc68, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x559dd10 | out: pCid=0x559dd10*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0211.853] WbemDefPath:IUnknown:Release (This=0xa0cc68) returned 0x3 [0211.853] CoGetContextToken (in: pToken=0x559dd68 | out: pToken=0x559dd68) returned 0x0 [0211.853] CoGetContextToken (in: pToken=0x559e170 | out: pToken=0x559e170) returned 0x0 [0211.853] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fe0ba0, riid=0x7463fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e200 | out: ppvObject=0x559e200*=0x0) returned 0x80004002 [0211.853] WbemDefPath:IUnknown:Release (This=0x5fe0ba0) returned 0x2 [0211.853] WbemDefPath:IUnknown:Release (This=0x5fe0ba0) returned 0x1 [0211.853] CoGetContextToken (in: pToken=0x559eaf8 | out: pToken=0x559eaf8) returned 0x0 [0211.853] CoGetContextToken (in: pToken=0x559ea58 | out: pToken=0x559ea58) returned 0x0 [0211.853] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fe0ba0, riid=0x559eb28*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x559eb24 | out: ppvObject=0x559eb24*=0x5fe0ba0) returned 0x0 [0211.853] WbemDefPath:IUnknown:AddRef (This=0x5fe0ba0) returned 0x3 [0211.853] WbemDefPath:IUnknown:Release (This=0x5fe0ba0) returned 0x2 [0211.853] WbemDefPath:IWbemPath:SetText (This=0x5fe0ba0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0211.853] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5fe0ba0, puCount=0x559eca4 | out: puCount=0x559eca4*=0x2) returned 0x0 [0211.853] WbemDefPath:IWbemPath:GetText (in: This=0x5fe0ba0, lFlags=4, puBuffLength=0x559eca0*=0x0, pszText=0x0 | out: puBuffLength=0x559eca0*=0xf, pszText=0x0) returned 0x0 [0211.853] WbemDefPath:IWbemPath:GetText (in: This=0x5fe0ba0, lFlags=4, puBuffLength=0x559eca0*=0xf, pszText="00000000000000" | out: puBuffLength=0x559eca0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0211.854] CoGetObjectContext (in: riid=0x24bbd70*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x559eca4 | out: ppv=0x559eca4*=0x98faac) returned 0x0 [0211.854] IComThreadingInfo:GetCurrentApartmentType (in: This=0x98faac, pAptType=0x559ec9c | out: pAptType=0x559ec9c*=1) returned 0x0 [0211.854] IUnknown:QueryInterface (in: This=0x98faac, riid=0x24bbd58*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x559eca0 | out: ppvObject=0x559eca0*=0x0) returned 0x80004002 [0211.854] IUnknown:Release (This=0x98faac) returned 0x0 [0211.854] IIDFromString (in: lpsz="{4590F811-1D3A-11D0-891F-00AA004B2E24}", lpiid=0x559ebac | out: lpiid=0x559ebac) returned 0x0 [0211.855] CoGetClassObject (in: rclsid=0xa2264c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7459d1fc*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x559e8c0 | out: ppv=0x559e8c0*=0x5fe0a80) returned 0x0 [0211.860] WbemLocator:IUnknown:QueryInterface (in: This=0x5fe0a80, riid=0x745d0ae0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x559ead8 | out: ppvObject=0x559ead8*=0x0) returned 0x80004002 [0211.860] WbemLocator:IClassFactory:CreateInstance (in: This=0x5fe0a80, pUnkOuter=0x0, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559eaec | out: ppvObject=0x559eaec*=0x5fe0d60) returned 0x0 [0211.860] WbemLocator:IUnknown:Release (This=0x5fe0a80) returned 0x0 [0211.861] WbemLocator:IUnknown:QueryInterface (in: This=0x5fe0d60, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e70c | out: ppvObject=0x559e70c*=0x5fe0d60) returned 0x0 [0211.861] WbemLocator:IUnknown:QueryInterface (in: This=0x5fe0d60, riid=0x7463fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x559e6c8 | out: ppvObject=0x559e6c8*=0x0) returned 0x80004002 [0211.861] WbemLocator:IUnknown:AddRef (This=0x5fe0d60) returned 0x3 [0211.861] WbemLocator:IUnknown:QueryInterface (in: This=0x5fe0d60, riid=0x7463f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x559e024 | out: ppvObject=0x559e024*=0x0) returned 0x80004002 [0211.861] WbemLocator:IUnknown:QueryInterface (in: This=0x5fe0d60, riid=0x7463f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x559dfd4 | out: ppvObject=0x559dfd4*=0x0) returned 0x80004002 [0211.861] WbemLocator:IUnknown:QueryInterface (in: This=0x5fe0d60, riid=0x7462c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559dfe0 | out: ppvObject=0x559dfe0*=0x0) returned 0x80004002 [0211.861] CoGetContextToken (in: pToken=0x559e040 | out: pToken=0x559e040) returned 0x0 [0211.861] CoGetObjectContext (in: riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0xa16d9c | out: ppv=0xa16d9c*=0x98faa0) returned 0x0 [0211.861] CoGetContextToken (in: pToken=0x559e448 | out: pToken=0x559e448) returned 0x0 [0211.861] WbemLocator:IUnknown:QueryInterface (in: This=0x5fe0d60, riid=0x7463fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e4d8 | out: ppvObject=0x559e4d8*=0x0) returned 0x80004002 [0211.861] WbemLocator:IUnknown:Release (This=0x5fe0d60) returned 0x2 [0211.861] WbemLocator:IUnknown:Release (This=0x5fe0d60) returned 0x1 [0211.862] CoGetContextToken (in: pToken=0x559eab8 | out: pToken=0x559eab8) returned 0x0 [0211.862] CoGetContextToken (in: pToken=0x559ea18 | out: pToken=0x559ea18) returned 0x0 [0211.862] WbemLocator:IUnknown:QueryInterface (in: This=0x5fe0d60, riid=0x559eae8*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x559eae4 | out: ppvObject=0x559eae4*=0x5fe0d60) returned 0x0 [0211.862] WbemLocator:IUnknown:AddRef (This=0x5fe0d60) returned 0x3 [0211.862] WbemLocator:IUnknown:Release (This=0x5fe0d60) returned 0x2 [0211.864] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5fe0ba0, puCount=0x559ec80 | out: puCount=0x559ec80*=0x2) returned 0x0 [0211.864] WbemDefPath:IWbemPath:GetText (in: This=0x5fe0ba0, lFlags=8, puBuffLength=0x559ec7c*=0x0, pszText=0x0 | out: puBuffLength=0x559ec7c*=0xf, pszText=0x0) returned 0x0 [0211.864] WbemDefPath:IWbemPath:GetText (in: This=0x5fe0ba0, lFlags=8, puBuffLength=0x559ec7c*=0xf, pszText="00000000000000" | out: puBuffLength=0x559ec7c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0211.864] CoCreateInstance (in: rclsid=0x6ed41284*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6ed412e4*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x559eb58 | out: ppv=0x559eb58*=0x5fe0d70) returned 0x0 [0211.864] WbemLocator:IWbemLocator:ConnectServer (in: This=0x5fe0d70, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x559ebec | out: ppNamespace=0x559ebec*=0x5fed544) returned 0x0 [0211.913] WbemLocator:IUnknown:QueryInterface (in: This=0x5fed544, riid=0x6ed41104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559ea88 | out: ppvObject=0x559ea88*=0x9fa39c) returned 0x0 [0211.914] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x9fa39c, pProxy=0x5fed544, pAuthnSvc=0x559ead8, pAuthzSvc=0x559ead4, pServerPrincName=0x559eacc, pAuthnLevel=0x559ead0, pImpLevel=0x559eac0, pAuthInfo=0x559eac4, pCapabilites=0x559eac8 | out: pAuthnSvc=0x559ead8*=0xa, pAuthzSvc=0x559ead4*=0x0, pServerPrincName=0x559eacc, pAuthnLevel=0x559ead0*=0x6, pImpLevel=0x559eac0*=0x2, pAuthInfo=0x559eac4, pCapabilites=0x559eac8*=0x1) returned 0x0 [0211.914] WbemLocator:IUnknown:Release (This=0x9fa39c) returned 0x1 [0211.914] WbemLocator:IUnknown:QueryInterface (in: This=0x5fed544, riid=0x6ed410f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559ea7c | out: ppvObject=0x559ea7c*=0x9fa3bc) returned 0x0 [0211.914] WbemLocator:IUnknown:QueryInterface (in: This=0x5fed544, riid=0x6ed41104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559ea78 | out: ppvObject=0x559ea78*=0x9fa39c) returned 0x0 [0211.914] WbemLocator:IClientSecurity:SetBlanket (This=0x9fa39c, pProxy=0x5fed544, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0211.914] WbemLocator:IUnknown:Release (This=0x9fa39c) returned 0x2 [0211.914] WbemLocator:IUnknown:Release (This=0x9fa3bc) returned 0x1 [0211.915] CoTaskMemFree (pv=0xa22760) [0211.915] WbemLocator:IUnknown:Release (This=0x5fe0d70) returned 0x0 [0211.915] WbemLocator:IUnknown:QueryInterface (in: This=0x5fed544, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e678 | out: ppvObject=0x559e678*=0x9fa3bc) returned 0x0 [0211.915] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa3bc, riid=0x7463fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x559e634 | out: ppvObject=0x559e634*=0x0) returned 0x80004002 [0211.915] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa3bc, riid=0x7463fe90*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x559e454 | out: ppvObject=0x559e454*=0x0) returned 0x80004002 [0211.916] WbemLocator:IUnknown:AddRef (This=0x9fa3bc) returned 0x3 [0211.916] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa3bc, riid=0x7463f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x559df94 | out: ppvObject=0x559df94*=0x0) returned 0x80004002 [0211.916] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa3bc, riid=0x7463f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x559df44 | out: ppvObject=0x559df44*=0x0) returned 0x80004002 [0211.919] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa3bc, riid=0x7462c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559df50 | out: ppvObject=0x559df50*=0x9fa31c) returned 0x0 [0211.919] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x9fa31c, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x559df58 | out: pCid=0x559df58*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0211.919] WbemLocator:IUnknown:Release (This=0x9fa31c) returned 0x3 [0211.919] CoGetContextToken (in: pToken=0x559dfb0 | out: pToken=0x559dfb0) returned 0x0 [0211.919] CoGetContextToken (in: pToken=0x559e3b8 | out: pToken=0x559e3b8) returned 0x0 [0211.919] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa3bc, riid=0x7463fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e448 | out: ppvObject=0x559e448*=0x9fa3a4) returned 0x0 [0211.920] WbemLocator:IRpcOptions:Query (in: This=0x9fa3a4, pPrx=0x9fa3bc, dwProperty=2, pdwValue=0x559e470 | out: pdwValue=0x559e470) returned 0x80004002 [0211.920] WbemLocator:IUnknown:Release (This=0x9fa3a4) returned 0x3 [0211.920] WbemLocator:IUnknown:Release (This=0x9fa3bc) returned 0x2 [0211.920] CoGetContextToken (in: pToken=0x559e988 | out: pToken=0x559e988) returned 0x0 [0211.920] CoGetContextToken (in: pToken=0x559e8e8 | out: pToken=0x559e8e8) returned 0x0 [0211.920] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa3bc, riid=0x559e9b8*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x559e9b4 | out: ppvObject=0x559e9b4*=0x5fed544) returned 0x0 [0211.920] WbemLocator:IUnknown:AddRef (This=0x5fed544) returned 0x4 [0211.920] WbemLocator:IUnknown:Release (This=0x5fed544) returned 0x3 [0211.921] WbemLocator:IUnknown:Release (This=0x5fed544) returned 0x2 [0211.926] SysStringLen (param_1=0x0) returned 0x0 [0211.926] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5fe0820, puCount=0x559ed50 | out: puCount=0x559ed50*=0x0) returned 0x0 [0211.926] WbemDefPath:IWbemPath:GetText (in: This=0x5fe0820, lFlags=2, puBuffLength=0x559ed4c*=0x0, pszText=0x0 | out: puBuffLength=0x559ed4c*=0x20, pszText=0x0) returned 0x0 [0211.926] WbemDefPath:IWbemPath:GetText (in: This=0x5fe0820, lFlags=2, puBuffLength=0x559ed4c*=0x20, pszText="0000000000000000000000000000000" | out: puBuffLength=0x559ed4c*=0x20, pszText="win32_logicaldisk.deviceid=\"C:\"") returned 0x0 [0211.926] CoGetContextToken (in: pToken=0x559e9c0 | out: pToken=0x559e9c0) returned 0x0 [0211.926] WbemLocator:IUnknown:AddRef (This=0x9fa3bc) returned 0x3 [0211.926] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa3bc, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e854 | out: ppvObject=0x559e854*=0x9fa3bc) returned 0x0 [0211.927] WbemLocator:IUnknown:Release (This=0x9fa3bc) returned 0x3 [0211.927] WbemLocator:IUnknown:Release (This=0x9fa3bc) returned 0x2 [0211.927] WbemDefPath:IWbemPath:GetText (in: This=0x5fe0820, lFlags=2, puBuffLength=0x559ed54*=0x0, pszText=0x0 | out: puBuffLength=0x559ed54*=0x20, pszText=0x0) returned 0x0 [0211.927] WbemDefPath:IWbemPath:GetText (in: This=0x5fe0820, lFlags=2, puBuffLength=0x559ed54*=0x20, pszText="0000000000000000000000000000000" | out: puBuffLength=0x559ed54*=0x20, pszText="win32_logicaldisk.deviceid=\"C:\"") returned 0x0 [0212.094] IWbemServices:GetObject (in: This=0x5fed544, strObjectPath="win32_logicaldisk.deviceid=\"C:\"", lFlags=0, pCtx=0x0, ppObject=0x559ed08*=0x0, ppCallResult=0x0 | out: ppObject=0x559ed08*=0x5feefb0, ppCallResult=0x0) returned 0x0 [0212.503] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5fe0ba0, puCount=0x559ed08 | out: puCount=0x559ed08*=0x2) returned 0x0 [0212.503] WbemDefPath:IWbemPath:GetText (in: This=0x5fe0ba0, lFlags=4, puBuffLength=0x559ed04*=0x0, pszText=0x0 | out: puBuffLength=0x559ed04*=0xf, pszText=0x0) returned 0x0 [0212.503] WbemDefPath:IWbemPath:GetText (in: This=0x5fe0ba0, lFlags=4, puBuffLength=0x559ed04*=0xf, pszText="00000000000000" | out: puBuffLength=0x559ed04*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0212.503] IWbemClassObject:Get (in: This=0x5feefb0, wszName="VolumeSerialNumber", lFlags=0, pVal=0x559ed04*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24bfaa0*=0, plFlavor=0x24bfaa4*=0 | out: pVal=0x559ed04*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="9C354B42", varVal2=0x0), pType=0x24bfaa0*=8, plFlavor=0x24bfaa4*=0) returned 0x0 [0212.503] SysStringByteLen (bstr="9C354B42") returned 0x10 [0212.503] SysStringByteLen (bstr="9C354B42") returned 0x10 [0212.503] IWbemClassObject:Get (in: This=0x5feefb0, wszName="VolumeSerialNumber", lFlags=0, pVal=0x559ed0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24bfaa0*=8, plFlavor=0x24bfaa4*=0 | out: pVal=0x559ed0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="9C354B42", varVal2=0x0), pType=0x24bfaa0*=8, plFlavor=0x24bfaa4*=0) returned 0x0 [0212.504] SysStringByteLen (bstr="9C354B42") returned 0x10 [0212.504] SysStringByteLen (bstr="9C354B42") returned 0x10 [0212.505] CoGetObjectContext (in: riid=0x24bbd70*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x559ed34 | out: ppv=0x559ed34*=0x98faac) returned 0x0 [0212.505] IComThreadingInfo:GetCurrentApartmentType (in: This=0x98faac, pAptType=0x559ed2c | out: pAptType=0x559ed2c*=1) returned 0x0 [0212.505] IUnknown:QueryInterface (in: This=0x98faac, riid=0x24bbd58*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x559ed30 | out: ppvObject=0x559ed30*=0x0) returned 0x80004002 [0212.505] IUnknown:Release (This=0x98faac) returned 0x1 [0212.506] CoGetClassObject (in: rclsid=0xa2255c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7459d1fc*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x559e6a0 | out: ppv=0x559e6a0*=0x5fe0d70) returned 0x0 [0212.506] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fe0d70, riid=0x745d0ae0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x559e8b8 | out: ppvObject=0x559e8b8*=0x0) returned 0x80004002 [0212.506] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5fe0d70, pUnkOuter=0x0, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e8cc | out: ppvObject=0x559e8cc*=0x5fecc08) returned 0x0 [0212.506] WbemDefPath:IUnknown:Release (This=0x5fe0d70) returned 0x0 [0212.506] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fecc08, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e4ec | out: ppvObject=0x559e4ec*=0x5fecc08) returned 0x0 [0212.507] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fecc08, riid=0x7463fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x559e4a8 | out: ppvObject=0x559e4a8*=0x0) returned 0x80004002 [0212.507] WbemDefPath:IUnknown:AddRef (This=0x5fecc08) returned 0x3 [0212.507] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fecc08, riid=0x7463f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x559de04 | out: ppvObject=0x559de04*=0x0) returned 0x80004002 [0212.507] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fecc08, riid=0x7463f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x559ddb4 | out: ppvObject=0x559ddb4*=0x0) returned 0x80004002 [0212.507] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fecc08, riid=0x7462c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559ddc0 | out: ppvObject=0x559ddc0*=0xa35dd0) returned 0x0 [0212.507] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xa35dd0, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x559ddc8 | out: pCid=0x559ddc8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0212.507] WbemDefPath:IUnknown:Release (This=0xa35dd0) returned 0x3 [0212.507] CoGetContextToken (in: pToken=0x559de20 | out: pToken=0x559de20) returned 0x0 [0212.507] CoGetContextToken (in: pToken=0x559e228 | out: pToken=0x559e228) returned 0x0 [0212.507] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fecc08, riid=0x7463fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e2b8 | out: ppvObject=0x559e2b8*=0x0) returned 0x80004002 [0212.507] WbemDefPath:IUnknown:Release (This=0x5fecc08) returned 0x2 [0212.507] WbemDefPath:IUnknown:Release (This=0x5fecc08) returned 0x1 [0212.507] CoGetContextToken (in: pToken=0x559ebb0 | out: pToken=0x559ebb0) returned 0x0 [0212.507] CoGetContextToken (in: pToken=0x559eb10 | out: pToken=0x559eb10) returned 0x0 [0212.507] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fecc08, riid=0x559ebe0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x559ebdc | out: ppvObject=0x559ebdc*=0x5fecc08) returned 0x0 [0212.507] WbemDefPath:IUnknown:AddRef (This=0x5fecc08) returned 0x3 [0212.507] WbemDefPath:IUnknown:Release (This=0x5fecc08) returned 0x2 [0212.507] WbemDefPath:IWbemPath:SetText (This=0x5fecc08, uMode=0x4, pszPath="Win32_OperatingSystem=@") returned 0x0 [0212.507] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5fecc08, puCount=0x559ed60 | out: puCount=0x559ed60*=0x0) returned 0x0 [0212.507] WbemDefPath:IWbemPath:GetText (in: This=0x5fecc08, lFlags=2, puBuffLength=0x559ed5c*=0x0, pszText=0x0 | out: puBuffLength=0x559ed5c*=0x18, pszText=0x0) returned 0x0 [0212.507] WbemDefPath:IWbemPath:GetText (in: This=0x5fecc08, lFlags=2, puBuffLength=0x559ed5c*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x559ed5c*=0x18, pszText="Win32_OperatingSystem=@") returned 0x0 [0212.507] WbemDefPath:IWbemPath:GetInfo (in: This=0x5fecc08, uRequestedInfo=0x0, puResponse=0x559ed68 | out: puResponse=0x559ed68*=0x1d19) returned 0x0 [0212.507] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5fecc08, puCount=0x559ed60 | out: puCount=0x559ed60*=0x0) returned 0x0 [0212.507] WbemDefPath:IWbemPath:GetInfo (in: This=0x5fecc08, uRequestedInfo=0x0, puResponse=0x559ed68 | out: puResponse=0x559ed68*=0x1d19) returned 0x0 [0212.507] WbemDefPath:IWbemPath:GetInfo (in: This=0x5fecc08, uRequestedInfo=0x0, puResponse=0x559ed68 | out: puResponse=0x559ed68*=0x1d19) returned 0x0 [0212.507] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5fecc08, puCount=0x559ed08 | out: puCount=0x559ed08*=0x0) returned 0x0 [0212.508] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5fe09c0, puCount=0x559ecf4 | out: puCount=0x559ecf4*=0x2) returned 0x0 [0212.508] WbemDefPath:IWbemPath:GetText (in: This=0x5fe09c0, lFlags=4, puBuffLength=0x559ecf0*=0x0, pszText=0x0 | out: puBuffLength=0x559ecf0*=0xf, pszText=0x0) returned 0x0 [0212.508] WbemDefPath:IWbemPath:GetText (in: This=0x5fe09c0, lFlags=4, puBuffLength=0x559ecf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x559ecf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0212.508] CoGetObjectContext (in: riid=0x24bbd70*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x559eca4 | out: ppv=0x559eca4*=0x98faac) returned 0x0 [0212.508] IComThreadingInfo:GetCurrentApartmentType (in: This=0x98faac, pAptType=0x559ec9c | out: pAptType=0x559ec9c*=1) returned 0x0 [0212.508] IUnknown:QueryInterface (in: This=0x98faac, riid=0x24bbd58*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x559eca0 | out: ppvObject=0x559eca0*=0x0) returned 0x80004002 [0212.508] IUnknown:Release (This=0x98faac) returned 0x1 [0212.508] CoGetClassObject (in: rclsid=0xa2255c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7459d1fc*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x559e610 | out: ppv=0x559e610*=0x5fe0d80) returned 0x0 [0212.508] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fe0d80, riid=0x745d0ae0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x559e828 | out: ppvObject=0x559e828*=0x0) returned 0x80004002 [0212.509] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5fe0d80, pUnkOuter=0x0, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e83c | out: ppvObject=0x559e83c*=0x5fef198) returned 0x0 [0212.509] WbemDefPath:IUnknown:Release (This=0x5fe0d80) returned 0x0 [0212.509] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fef198, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e45c | out: ppvObject=0x559e45c*=0x5fef198) returned 0x0 [0212.509] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fef198, riid=0x7463fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x559e418 | out: ppvObject=0x559e418*=0x0) returned 0x80004002 [0212.509] WbemDefPath:IUnknown:AddRef (This=0x5fef198) returned 0x3 [0212.509] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fef198, riid=0x7463f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x559dd74 | out: ppvObject=0x559dd74*=0x0) returned 0x80004002 [0212.509] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fef198, riid=0x7463f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x559dd24 | out: ppvObject=0x559dd24*=0x0) returned 0x80004002 [0212.509] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fef198, riid=0x7462c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559dd30 | out: ppvObject=0x559dd30*=0xa35df0) returned 0x0 [0212.509] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xa35df0, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x559dd38 | out: pCid=0x559dd38*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0212.509] WbemDefPath:IUnknown:Release (This=0xa35df0) returned 0x3 [0212.509] CoGetContextToken (in: pToken=0x559dd90 | out: pToken=0x559dd90) returned 0x0 [0212.509] CoGetContextToken (in: pToken=0x559e198 | out: pToken=0x559e198) returned 0x0 [0212.509] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fef198, riid=0x7463fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e228 | out: ppvObject=0x559e228*=0x0) returned 0x80004002 [0212.509] WbemDefPath:IUnknown:Release (This=0x5fef198) returned 0x2 [0212.509] WbemDefPath:IUnknown:Release (This=0x5fef198) returned 0x1 [0212.509] CoGetContextToken (in: pToken=0x559eb20 | out: pToken=0x559eb20) returned 0x0 [0212.509] CoGetContextToken (in: pToken=0x559ea80 | out: pToken=0x559ea80) returned 0x0 [0212.509] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fef198, riid=0x559eb50*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x559eb4c | out: ppvObject=0x559eb4c*=0x5fef198) returned 0x0 [0212.509] WbemDefPath:IUnknown:AddRef (This=0x5fef198) returned 0x3 [0212.509] WbemDefPath:IUnknown:Release (This=0x5fef198) returned 0x2 [0212.509] WbemDefPath:IWbemPath:SetText (This=0x5fef198, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0212.509] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5fef198, puCount=0x559eccc | out: puCount=0x559eccc*=0x2) returned 0x0 [0212.509] WbemDefPath:IWbemPath:GetText (in: This=0x5fef198, lFlags=4, puBuffLength=0x559ecc8*=0x0, pszText=0x0 | out: puBuffLength=0x559ecc8*=0xf, pszText=0x0) returned 0x0 [0212.509] WbemDefPath:IWbemPath:GetText (in: This=0x5fef198, lFlags=4, puBuffLength=0x559ecc8*=0xf, pszText="00000000000000" | out: puBuffLength=0x559ecc8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0212.510] CoGetObjectContext (in: riid=0x24bbd70*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x559eccc | out: ppv=0x559eccc*=0x98faac) returned 0x0 [0212.510] IComThreadingInfo:GetCurrentApartmentType (in: This=0x98faac, pAptType=0x559ecc4 | out: pAptType=0x559ecc4*=1) returned 0x0 [0212.510] IUnknown:QueryInterface (in: This=0x98faac, riid=0x24bbd58*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x559ecc8 | out: ppvObject=0x559ecc8*=0x0) returned 0x80004002 [0212.510] IUnknown:Release (This=0x98faac) returned 0x1 [0212.510] CoGetClassObject (in: rclsid=0xa2264c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7459d1fc*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x559e8e8 | out: ppv=0x559e8e8*=0x5fef308) returned 0x0 [0212.510] WbemLocator:IUnknown:QueryInterface (in: This=0x5fef308, riid=0x745d0ae0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x559eb00 | out: ppvObject=0x559eb00*=0x0) returned 0x80004002 [0212.510] WbemLocator:IClassFactory:CreateInstance (in: This=0x5fef308, pUnkOuter=0x0, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559eb14 | out: ppvObject=0x559eb14*=0x5fef6d8) returned 0x0 [0212.510] WbemLocator:IUnknown:Release (This=0x5fef308) returned 0x0 [0212.510] WbemLocator:IUnknown:QueryInterface (in: This=0x5fef6d8, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e734 | out: ppvObject=0x559e734*=0x5fef6d8) returned 0x0 [0212.510] WbemLocator:IUnknown:QueryInterface (in: This=0x5fef6d8, riid=0x7463fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x559e6f0 | out: ppvObject=0x559e6f0*=0x0) returned 0x80004002 [0212.511] WbemLocator:IUnknown:AddRef (This=0x5fef6d8) returned 0x3 [0212.511] WbemLocator:IUnknown:QueryInterface (in: This=0x5fef6d8, riid=0x7463f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x559e04c | out: ppvObject=0x559e04c*=0x0) returned 0x80004002 [0212.511] WbemLocator:IUnknown:QueryInterface (in: This=0x5fef6d8, riid=0x7463f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x559dffc | out: ppvObject=0x559dffc*=0x0) returned 0x80004002 [0212.511] WbemLocator:IUnknown:QueryInterface (in: This=0x5fef6d8, riid=0x7462c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e008 | out: ppvObject=0x559e008*=0x0) returned 0x80004002 [0212.511] CoGetContextToken (in: pToken=0x559e068 | out: pToken=0x559e068) returned 0x0 [0212.511] CoGetContextToken (in: pToken=0x559e470 | out: pToken=0x559e470) returned 0x0 [0212.511] WbemLocator:IUnknown:QueryInterface (in: This=0x5fef6d8, riid=0x7463fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e500 | out: ppvObject=0x559e500*=0x0) returned 0x80004002 [0212.511] WbemLocator:IUnknown:Release (This=0x5fef6d8) returned 0x2 [0212.511] WbemLocator:IUnknown:Release (This=0x5fef6d8) returned 0x1 [0212.511] CoGetContextToken (in: pToken=0x559eae0 | out: pToken=0x559eae0) returned 0x0 [0212.511] CoGetContextToken (in: pToken=0x559ea40 | out: pToken=0x559ea40) returned 0x0 [0212.511] WbemLocator:IUnknown:QueryInterface (in: This=0x5fef6d8, riid=0x559eb10*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x559eb0c | out: ppvObject=0x559eb0c*=0x5fef6d8) returned 0x0 [0212.511] WbemLocator:IUnknown:AddRef (This=0x5fef6d8) returned 0x3 [0212.511] WbemLocator:IUnknown:Release (This=0x5fef6d8) returned 0x2 [0212.511] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5fef198, puCount=0x559eca8 | out: puCount=0x559eca8*=0x2) returned 0x0 [0212.511] WbemDefPath:IWbemPath:GetText (in: This=0x5fef198, lFlags=8, puBuffLength=0x559eca4*=0x0, pszText=0x0 | out: puBuffLength=0x559eca4*=0xf, pszText=0x0) returned 0x0 [0212.511] WbemDefPath:IWbemPath:GetText (in: This=0x5fef198, lFlags=8, puBuffLength=0x559eca4*=0xf, pszText="00000000000000" | out: puBuffLength=0x559eca4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0212.511] CoCreateInstance (in: rclsid=0x6ed41284*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6ed412e4*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x559eb80 | out: ppv=0x559eb80*=0x5fef6e8) returned 0x0 [0212.511] WbemLocator:IWbemLocator:ConnectServer (in: This=0x5fef6e8, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x559ec14 | out: ppNamespace=0x559ec14*=0x5fef7f4) returned 0x0 [0212.529] WbemLocator:IUnknown:QueryInterface (in: This=0x5fef7f4, riid=0x6ed41104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559eab0 | out: ppvObject=0x559eab0*=0x9fa48c) returned 0x0 [0212.529] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x9fa48c, pProxy=0x5fef7f4, pAuthnSvc=0x559eb00, pAuthzSvc=0x559eafc, pServerPrincName=0x559eaf4, pAuthnLevel=0x559eaf8, pImpLevel=0x559eae8, pAuthInfo=0x559eaec, pCapabilites=0x559eaf0 | out: pAuthnSvc=0x559eb00*=0xa, pAuthzSvc=0x559eafc*=0x0, pServerPrincName=0x559eaf4, pAuthnLevel=0x559eaf8*=0x6, pImpLevel=0x559eae8*=0x2, pAuthInfo=0x559eaec, pCapabilites=0x559eaf0*=0x1) returned 0x0 [0212.529] WbemLocator:IUnknown:Release (This=0x9fa48c) returned 0x1 [0212.529] WbemLocator:IUnknown:QueryInterface (in: This=0x5fef7f4, riid=0x6ed410f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559eaa4 | out: ppvObject=0x559eaa4*=0x9fa4ac) returned 0x0 [0212.530] WbemLocator:IUnknown:QueryInterface (in: This=0x5fef7f4, riid=0x6ed41104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559eaa0 | out: ppvObject=0x559eaa0*=0x9fa48c) returned 0x0 [0212.530] WbemLocator:IClientSecurity:SetBlanket (This=0x9fa48c, pProxy=0x5fef7f4, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0212.530] WbemLocator:IUnknown:Release (This=0x9fa48c) returned 0x2 [0212.530] WbemLocator:IUnknown:Release (This=0x9fa4ac) returned 0x1 [0212.530] CoTaskMemFree (pv=0xa22790) [0212.530] WbemLocator:IUnknown:Release (This=0x5fef6e8) returned 0x0 [0212.530] WbemLocator:IUnknown:QueryInterface (in: This=0x5fef7f4, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e6a0 | out: ppvObject=0x559e6a0*=0x9fa4ac) returned 0x0 [0212.530] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa4ac, riid=0x7463fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x559e65c | out: ppvObject=0x559e65c*=0x0) returned 0x80004002 [0212.533] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa4ac, riid=0x7463fe90*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x559e47c | out: ppvObject=0x559e47c*=0x0) returned 0x80004002 [0212.533] WbemLocator:IUnknown:AddRef (This=0x9fa4ac) returned 0x3 [0212.533] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa4ac, riid=0x7463f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x559dfbc | out: ppvObject=0x559dfbc*=0x0) returned 0x80004002 [0212.534] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa4ac, riid=0x7463f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x559df6c | out: ppvObject=0x559df6c*=0x0) returned 0x80004002 [0212.534] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa4ac, riid=0x7462c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559df78 | out: ppvObject=0x559df78*=0x9fa40c) returned 0x0 [0212.534] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x9fa40c, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x559df80 | out: pCid=0x559df80*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0212.534] WbemLocator:IUnknown:Release (This=0x9fa40c) returned 0x3 [0212.534] CoGetContextToken (in: pToken=0x559dfd8 | out: pToken=0x559dfd8) returned 0x0 [0212.534] CoGetContextToken (in: pToken=0x559e3e0 | out: pToken=0x559e3e0) returned 0x0 [0212.534] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa4ac, riid=0x7463fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e470 | out: ppvObject=0x559e470*=0x9fa494) returned 0x0 [0212.534] WbemLocator:IRpcOptions:Query (in: This=0x9fa494, pPrx=0x9fa4ac, dwProperty=2, pdwValue=0x559e498 | out: pdwValue=0x559e498) returned 0x80004002 [0212.534] WbemLocator:IUnknown:Release (This=0x9fa494) returned 0x3 [0212.534] WbemLocator:IUnknown:Release (This=0x9fa4ac) returned 0x2 [0212.534] CoGetContextToken (in: pToken=0x559e9b0 | out: pToken=0x559e9b0) returned 0x0 [0212.534] CoGetContextToken (in: pToken=0x559e910 | out: pToken=0x559e910) returned 0x0 [0212.534] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa4ac, riid=0x559e9e0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x559e9dc | out: ppvObject=0x559e9dc*=0x5fef7f4) returned 0x0 [0212.534] WbemLocator:IUnknown:AddRef (This=0x5fef7f4) returned 0x4 [0212.534] WbemLocator:IUnknown:Release (This=0x5fef7f4) returned 0x3 [0212.534] WbemLocator:IUnknown:Release (This=0x5fef7f4) returned 0x2 [0212.534] SysStringLen (param_1=0x0) returned 0x0 [0212.535] CoGetContextToken (in: pToken=0x559e978 | out: pToken=0x559e978) returned 0x0 [0212.535] WbemLocator:IUnknown:AddRef (This=0x9fa4ac) returned 0x3 [0212.535] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa4ac, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e80c | out: ppvObject=0x559e80c*=0x9fa4ac) returned 0x0 [0212.535] WbemLocator:IUnknown:Release (This=0x9fa4ac) returned 0x3 [0212.535] WbemLocator:IUnknown:Release (This=0x9fa4ac) returned 0x2 [0212.535] WbemDefPath:IWbemPath:GetText (in: This=0x5fecc08, lFlags=2, puBuffLength=0x559ed0c*=0x0, pszText=0x0 | out: puBuffLength=0x559ed0c*=0x18, pszText=0x0) returned 0x0 [0212.535] WbemDefPath:IWbemPath:GetText (in: This=0x5fecc08, lFlags=2, puBuffLength=0x559ed0c*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x559ed0c*=0x18, pszText="Win32_OperatingSystem=@") returned 0x0 [0212.535] IWbemServices:GetObject (in: This=0x5fef7f4, strObjectPath="Win32_OperatingSystem=@", lFlags=0, pCtx=0x0, ppObject=0x559ecc0*=0x0, ppCallResult=0x0 | out: ppObject=0x559ecc0*=0x5ff24d0, ppCallResult=0x0) returned 0x0 [0213.087] IWbemClassObject:Get (in: This=0x5ff24d0, wszName="__PATH", lFlags=0, pVal=0x559eca8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x559ed50*=0, plFlavor=0x559ed4c*=0 | out: pVal=0x559eca8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XDUWTFONO\\root\\cimv2:Win32_OperatingSystem=@", varVal2=0x0), pType=0x559ed50*=8, plFlavor=0x559ed4c*=64) returned 0x0 [0213.087] SysStringByteLen (bstr="\\\\XDUWTFONO\\root\\cimv2:Win32_OperatingSystem=@") returned 0x5c [0213.087] SysStringByteLen (bstr="\\\\XDUWTFONO\\root\\cimv2:Win32_OperatingSystem=@") returned 0x5c [0213.087] CoGetObjectContext (in: riid=0x24bbd70*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x559ecb8 | out: ppv=0x559ecb8*=0x98faac) returned 0x0 [0213.087] IComThreadingInfo:GetCurrentApartmentType (in: This=0x98faac, pAptType=0x559ecb0 | out: pAptType=0x559ecb0*=1) returned 0x0 [0213.087] IUnknown:QueryInterface (in: This=0x98faac, riid=0x24bbd58*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x559ecb4 | out: ppvObject=0x559ecb4*=0x0) returned 0x80004002 [0213.087] IUnknown:Release (This=0x98faac) returned 0x1 [0213.088] CoGetClassObject (in: rclsid=0xa2255c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7459d1fc*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x559e620 | out: ppv=0x559e620*=0x5fef6e8) returned 0x0 [0213.088] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fef6e8, riid=0x745d0ae0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x559e838 | out: ppvObject=0x559e838*=0x0) returned 0x80004002 [0213.088] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5fef6e8, pUnkOuter=0x0, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e84c | out: ppvObject=0x559e84c*=0x5fef6f8) returned 0x0 [0213.088] WbemDefPath:IUnknown:Release (This=0x5fef6e8) returned 0x0 [0213.089] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fef6f8, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e46c | out: ppvObject=0x559e46c*=0x5fef6f8) returned 0x0 [0213.089] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fef6f8, riid=0x7463fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x559e428 | out: ppvObject=0x559e428*=0x0) returned 0x80004002 [0213.089] WbemDefPath:IUnknown:AddRef (This=0x5fef6f8) returned 0x3 [0213.089] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fef6f8, riid=0x7463f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x559dd84 | out: ppvObject=0x559dd84*=0x0) returned 0x80004002 [0213.089] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fef6f8, riid=0x7463f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x559dd34 | out: ppvObject=0x559dd34*=0x0) returned 0x80004002 [0213.089] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fef6f8, riid=0x7462c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559dd40 | out: ppvObject=0x559dd40*=0xa35e30) returned 0x0 [0213.089] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xa35e30, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x559dd48 | out: pCid=0x559dd48*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0213.089] WbemDefPath:IUnknown:Release (This=0xa35e30) returned 0x3 [0213.089] CoGetContextToken (in: pToken=0x559dda0 | out: pToken=0x559dda0) returned 0x0 [0213.089] CoGetContextToken (in: pToken=0x559e1a8 | out: pToken=0x559e1a8) returned 0x0 [0213.089] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fef6f8, riid=0x7463fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e238 | out: ppvObject=0x559e238*=0x0) returned 0x80004002 [0213.089] WbemDefPath:IUnknown:Release (This=0x5fef6f8) returned 0x2 [0213.089] WbemDefPath:IUnknown:Release (This=0x5fef6f8) returned 0x1 [0213.089] CoGetContextToken (in: pToken=0x559eb30 | out: pToken=0x559eb30) returned 0x0 [0213.089] CoGetContextToken (in: pToken=0x559ea90 | out: pToken=0x559ea90) returned 0x0 [0213.089] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fef6f8, riid=0x559eb60*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x559eb5c | out: ppvObject=0x559eb5c*=0x5fef6f8) returned 0x0 [0213.089] WbemDefPath:IUnknown:AddRef (This=0x5fef6f8) returned 0x3 [0213.089] WbemDefPath:IUnknown:Release (This=0x5fef6f8) returned 0x2 [0213.089] WbemDefPath:IWbemPath:SetText (This=0x5fef6f8, uMode=0x4, pszPath="\\\\XDUWTFONO\\root\\cimv2:Win32_OperatingSystem=@") returned 0x0 [0213.090] IWbemClassObject:Get (in: This=0x5ff24d0, wszName="SerialNumber", lFlags=0, pVal=0x559ed04*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24c0e00*=0, plFlavor=0x24c0e04*=0 | out: pVal=0x559ed04*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="00371-223-0192745-86989", varVal2=0x0), pType=0x24c0e00*=8, plFlavor=0x24c0e04*=0) returned 0x0 [0213.090] SysStringByteLen (bstr="00371-223-0192745-86989") returned 0x2e [0213.090] SysStringByteLen (bstr="00371-223-0192745-86989") returned 0x2e [0213.090] IWbemClassObject:Get (in: This=0x5ff24d0, wszName="SerialNumber", lFlags=0, pVal=0x559ed0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24c0e00*=8, plFlavor=0x24c0e04*=0 | out: pVal=0x559ed0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="00371-223-0192745-86989", varVal2=0x0), pType=0x24c0e00*=8, plFlavor=0x24c0e04*=0) returned 0x0 [0213.090] SysStringByteLen (bstr="00371-223-0192745-86989") returned 0x2e [0213.090] SysStringByteLen (bstr="00371-223-0192745-86989") returned 0x2e [0213.090] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5fef198, puCount=0x559ed08 | out: puCount=0x559ed08*=0x2) returned 0x0 [0213.090] WbemDefPath:IWbemPath:GetText (in: This=0x5fef198, lFlags=4, puBuffLength=0x559ed04*=0x0, pszText=0x0 | out: puBuffLength=0x559ed04*=0xf, pszText=0x0) returned 0x0 [0213.090] WbemDefPath:IWbemPath:GetText (in: This=0x5fef198, lFlags=4, puBuffLength=0x559ed04*=0xf, pszText="00000000000000" | out: puBuffLength=0x559ed04*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0213.090] IWbemClassObject:Get (in: This=0x5ff24d0, wszName="Caption", lFlags=0, pVal=0x559ed04*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24c0ecc*=0, plFlavor=0x24c0ed0*=0 | out: pVal=0x559ed04*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Microsoft Windows 7 Professional ", varVal2=0x0), pType=0x24c0ecc*=8, plFlavor=0x24c0ed0*=0) returned 0x0 [0213.090] SysStringByteLen (bstr="Microsoft Windows 7 Professional ") returned 0x42 [0213.090] SysStringByteLen (bstr="Microsoft Windows 7 Professional ") returned 0x42 [0213.090] IWbemClassObject:Get (in: This=0x5ff24d0, wszName="Caption", lFlags=0, pVal=0x559ed0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24c0ecc*=8, plFlavor=0x24c0ed0*=0 | out: pVal=0x559ed0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Microsoft Windows 7 Professional ", varVal2=0x0), pType=0x24c0ecc*=8, plFlavor=0x24c0ed0*=0) returned 0x0 [0213.090] SysStringByteLen (bstr="Microsoft Windows 7 Professional ") returned 0x42 [0213.090] SysStringByteLen (bstr="Microsoft Windows 7 Professional ") returned 0x42 [0213.090] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5fef198, puCount=0x559ed08 | out: puCount=0x559ed08*=0x2) returned 0x0 [0213.090] WbemDefPath:IWbemPath:GetText (in: This=0x5fef198, lFlags=4, puBuffLength=0x559ed04*=0x0, pszText=0x0 | out: puBuffLength=0x559ed04*=0xf, pszText=0x0) returned 0x0 [0213.090] WbemDefPath:IWbemPath:GetText (in: This=0x5fef198, lFlags=4, puBuffLength=0x559ed04*=0xf, pszText="00000000000000" | out: puBuffLength=0x559ed04*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0213.090] IWbemClassObject:Get (in: This=0x5ff24d0, wszName="OSArchitecture", lFlags=0, pVal=0x559ed04*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24c0fc0*=0, plFlavor=0x24c0fc4*=0 | out: pVal=0x559ed04*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="64-bit", varVal2=0x0), pType=0x24c0fc0*=8, plFlavor=0x24c0fc4*=0) returned 0x0 [0213.091] SysStringByteLen (bstr="64-bit") returned 0xc [0213.091] SysStringByteLen (bstr="64-bit") returned 0xc [0213.091] IWbemClassObject:Get (in: This=0x5ff24d0, wszName="OSArchitecture", lFlags=0, pVal=0x559ed0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24c0fc0*=8, plFlavor=0x24c0fc4*=0 | out: pVal=0x559ed0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="64-bit", varVal2=0x0), pType=0x24c0fc0*=8, plFlavor=0x24c0fc4*=0) returned 0x0 [0213.091] SysStringByteLen (bstr="64-bit") returned 0xc [0213.091] SysStringByteLen (bstr="64-bit") returned 0xc [0213.091] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5fe09c0, puCount=0x559ed48 | out: puCount=0x559ed48*=0x2) returned 0x0 [0213.091] WbemDefPath:IWbemPath:GetText (in: This=0x5fe09c0, lFlags=4, puBuffLength=0x559ed44*=0x0, pszText=0x0 | out: puBuffLength=0x559ed44*=0xf, pszText=0x0) returned 0x0 [0213.091] WbemDefPath:IWbemPath:GetText (in: This=0x5fe09c0, lFlags=4, puBuffLength=0x559ed44*=0xf, pszText="00000000000000" | out: puBuffLength=0x559ed44*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0213.092] CoGetObjectContext (in: riid=0x24bbd70*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x559ecd4 | out: ppv=0x559ecd4*=0x98faac) returned 0x0 [0213.092] IComThreadingInfo:GetCurrentApartmentType (in: This=0x98faac, pAptType=0x559eccc | out: pAptType=0x559eccc*=1) returned 0x0 [0213.092] IUnknown:QueryInterface (in: This=0x98faac, riid=0x24bbd58*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x559ecd0 | out: ppvObject=0x559ecd0*=0x0) returned 0x80004002 [0213.092] IUnknown:Release (This=0x98faac) returned 0x1 [0213.092] CoGetClassObject (in: rclsid=0xa2264c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7459d1fc*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x559e8f0 | out: ppv=0x559e8f0*=0x5fef368) returned 0x0 [0213.093] WbemLocator:IUnknown:QueryInterface (in: This=0x5fef368, riid=0x745d0ae0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x559eb08 | out: ppvObject=0x559eb08*=0x0) returned 0x80004002 [0213.093] WbemLocator:IClassFactory:CreateInstance (in: This=0x5fef368, pUnkOuter=0x0, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559eb1c | out: ppvObject=0x559eb1c*=0x5fef6e8) returned 0x0 [0213.093] WbemLocator:IUnknown:Release (This=0x5fef368) returned 0x0 [0213.093] WbemLocator:IUnknown:QueryInterface (in: This=0x5fef6e8, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e73c | out: ppvObject=0x559e73c*=0x5fef6e8) returned 0x0 [0213.093] WbemLocator:IUnknown:QueryInterface (in: This=0x5fef6e8, riid=0x7463fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x559e6f8 | out: ppvObject=0x559e6f8*=0x0) returned 0x80004002 [0213.093] WbemLocator:IUnknown:AddRef (This=0x5fef6e8) returned 0x3 [0213.093] WbemLocator:IUnknown:QueryInterface (in: This=0x5fef6e8, riid=0x7463f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x559e054 | out: ppvObject=0x559e054*=0x0) returned 0x80004002 [0213.093] WbemLocator:IUnknown:QueryInterface (in: This=0x5fef6e8, riid=0x7463f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x559e004 | out: ppvObject=0x559e004*=0x0) returned 0x80004002 [0213.093] WbemLocator:IUnknown:QueryInterface (in: This=0x5fef6e8, riid=0x7462c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e010 | out: ppvObject=0x559e010*=0x0) returned 0x80004002 [0213.093] CoGetContextToken (in: pToken=0x559e070 | out: pToken=0x559e070) returned 0x0 [0213.093] CoGetContextToken (in: pToken=0x559e478 | out: pToken=0x559e478) returned 0x0 [0213.093] WbemLocator:IUnknown:QueryInterface (in: This=0x5fef6e8, riid=0x7463fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e508 | out: ppvObject=0x559e508*=0x0) returned 0x80004002 [0213.093] WbemLocator:IUnknown:Release (This=0x5fef6e8) returned 0x2 [0213.093] WbemLocator:IUnknown:Release (This=0x5fef6e8) returned 0x1 [0213.093] CoGetContextToken (in: pToken=0x559eae8 | out: pToken=0x559eae8) returned 0x0 [0213.093] CoGetContextToken (in: pToken=0x559ea48 | out: pToken=0x559ea48) returned 0x0 [0213.093] WbemLocator:IUnknown:QueryInterface (in: This=0x5fef6e8, riid=0x559eb18*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x559eb14 | out: ppvObject=0x559eb14*=0x5fef6e8) returned 0x0 [0213.093] WbemLocator:IUnknown:AddRef (This=0x5fef6e8) returned 0x3 [0213.093] WbemLocator:IUnknown:Release (This=0x5fef6e8) returned 0x2 [0213.093] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5fe09c0, puCount=0x559ecb0 | out: puCount=0x559ecb0*=0x2) returned 0x0 [0213.093] WbemDefPath:IWbemPath:GetText (in: This=0x5fe09c0, lFlags=8, puBuffLength=0x559ecac*=0x0, pszText=0x0 | out: puBuffLength=0x559ecac*=0xf, pszText=0x0) returned 0x0 [0213.094] WbemDefPath:IWbemPath:GetText (in: This=0x5fe09c0, lFlags=8, puBuffLength=0x559ecac*=0xf, pszText="00000000000000" | out: puBuffLength=0x559ecac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0213.094] CoCreateInstance (in: rclsid=0x6ed41284*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6ed412e4*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x559eb88 | out: ppv=0x559eb88*=0x5fef790) returned 0x0 [0213.094] WbemLocator:IWbemLocator:ConnectServer (in: This=0x5fef790, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x559ec1c | out: ppNamespace=0x559ec1c*=0x5ff28ac) returned 0x0 [0213.110] WbemLocator:IUnknown:QueryInterface (in: This=0x5ff28ac, riid=0x6ed41104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559eab8 | out: ppvObject=0x559eab8*=0x9fa57c) returned 0x0 [0213.110] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x9fa57c, pProxy=0x5ff28ac, pAuthnSvc=0x559eb08, pAuthzSvc=0x559eb04, pServerPrincName=0x559eafc, pAuthnLevel=0x559eb00, pImpLevel=0x559eaf0, pAuthInfo=0x559eaf4, pCapabilites=0x559eaf8 | out: pAuthnSvc=0x559eb08*=0xa, pAuthzSvc=0x559eb04*=0x0, pServerPrincName=0x559eafc, pAuthnLevel=0x559eb00*=0x6, pImpLevel=0x559eaf0*=0x2, pAuthInfo=0x559eaf4, pCapabilites=0x559eaf8*=0x1) returned 0x0 [0213.110] WbemLocator:IUnknown:Release (This=0x9fa57c) returned 0x1 [0213.111] WbemLocator:IUnknown:QueryInterface (in: This=0x5ff28ac, riid=0x6ed410f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559eaac | out: ppvObject=0x559eaac*=0x9fa59c) returned 0x0 [0213.111] WbemLocator:IUnknown:QueryInterface (in: This=0x5ff28ac, riid=0x6ed41104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559eaa8 | out: ppvObject=0x559eaa8*=0x9fa57c) returned 0x0 [0213.111] WbemLocator:IClientSecurity:SetBlanket (This=0x9fa57c, pProxy=0x5ff28ac, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0213.111] WbemLocator:IUnknown:Release (This=0x9fa57c) returned 0x2 [0213.111] WbemLocator:IUnknown:Release (This=0x9fa59c) returned 0x1 [0213.111] CoTaskMemFree (pv=0xa22730) [0213.111] WbemLocator:IUnknown:Release (This=0x5fef790) returned 0x0 [0213.111] WbemLocator:IUnknown:QueryInterface (in: This=0x5ff28ac, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e6a8 | out: ppvObject=0x559e6a8*=0x9fa59c) returned 0x0 [0213.111] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa59c, riid=0x7463fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x559e664 | out: ppvObject=0x559e664*=0x0) returned 0x80004002 [0213.111] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa59c, riid=0x7463fe90*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x559e484 | out: ppvObject=0x559e484*=0x0) returned 0x80004002 [0213.112] WbemLocator:IUnknown:AddRef (This=0x9fa59c) returned 0x3 [0213.112] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa59c, riid=0x7463f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x559dfc4 | out: ppvObject=0x559dfc4*=0x0) returned 0x80004002 [0213.112] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa59c, riid=0x7463f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x559df74 | out: ppvObject=0x559df74*=0x0) returned 0x80004002 [0213.112] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa59c, riid=0x7462c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559df80 | out: ppvObject=0x559df80*=0x9fa4fc) returned 0x0 [0213.113] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x9fa4fc, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x559df88 | out: pCid=0x559df88*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0213.113] WbemLocator:IUnknown:Release (This=0x9fa4fc) returned 0x3 [0213.113] CoGetContextToken (in: pToken=0x559dfe0 | out: pToken=0x559dfe0) returned 0x0 [0213.113] CoGetContextToken (in: pToken=0x559e3e8 | out: pToken=0x559e3e8) returned 0x0 [0213.113] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa59c, riid=0x7463fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e478 | out: ppvObject=0x559e478*=0x9fa584) returned 0x0 [0213.113] WbemLocator:IRpcOptions:Query (in: This=0x9fa584, pPrx=0x9fa59c, dwProperty=2, pdwValue=0x559e4a0 | out: pdwValue=0x559e4a0) returned 0x80004002 [0213.113] WbemLocator:IUnknown:Release (This=0x9fa584) returned 0x3 [0213.113] WbemLocator:IUnknown:Release (This=0x9fa59c) returned 0x2 [0213.113] CoGetContextToken (in: pToken=0x559e9b8 | out: pToken=0x559e9b8) returned 0x0 [0213.113] CoGetContextToken (in: pToken=0x559e918 | out: pToken=0x559e918) returned 0x0 [0213.113] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa59c, riid=0x559e9e8*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x559e9e4 | out: ppvObject=0x559e9e4*=0x5ff28ac) returned 0x0 [0213.113] WbemLocator:IUnknown:AddRef (This=0x5ff28ac) returned 0x4 [0213.113] WbemLocator:IUnknown:Release (This=0x5ff28ac) returned 0x3 [0213.113] WbemLocator:IUnknown:Release (This=0x5ff28ac) returned 0x2 [0213.113] SysStringLen (param_1=0x0) returned 0x0 [0213.113] CoGetContextToken (in: pToken=0x559e9b0 | out: pToken=0x559e9b0) returned 0x0 [0213.113] WbemLocator:IUnknown:AddRef (This=0x9fa59c) returned 0x3 [0213.113] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa59c, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e844 | out: ppvObject=0x559e844*=0x9fa59c) returned 0x0 [0213.113] WbemLocator:IUnknown:Release (This=0x9fa59c) returned 0x3 [0213.113] WbemLocator:IUnknown:Release (This=0x9fa59c) returned 0x2 [0213.113] CoGetContextToken (in: pToken=0x559eaa8 | out: pToken=0x559eaa8) returned 0x0 [0213.113] WbemLocator:IUnknown:AddRef (This=0x5ff28ac) returned 0x3 [0213.113] IWbemServices:ExecQuery (in: This=0x5ff28ac, strQueryLanguage="WQL", strQuery="select * from Win32_Processor", lFlags=16, pCtx=0x0, ppEnum=0x559ecb8 | out: ppEnum=0x559ecb8*=0x5ff294c) returned 0x0 [0213.123] IUnknown:QueryInterface (in: This=0x5ff294c, riid=0x6ed41104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559eb1c | out: ppvObject=0x559eb1c*=0x5ff2950) returned 0x0 [0213.123] IClientSecurity:QueryBlanket (in: This=0x5ff2950, pProxy=0x5ff294c, pAuthnSvc=0x559eb6c, pAuthzSvc=0x559eb68, pServerPrincName=0x559eb60, pAuthnLevel=0x559eb64, pImpLevel=0x559eb54, pAuthInfo=0x559eb58, pCapabilites=0x559eb5c | out: pAuthnSvc=0x559eb6c*=0xa, pAuthzSvc=0x559eb68*=0x0, pServerPrincName=0x559eb60, pAuthnLevel=0x559eb64*=0x6, pImpLevel=0x559eb54*=0x2, pAuthInfo=0x559eb58, pCapabilites=0x559eb5c*=0x1) returned 0x0 [0213.123] IUnknown:Release (This=0x5ff2950) returned 0x1 [0213.123] IUnknown:QueryInterface (in: This=0x5ff294c, riid=0x6ed410f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559eb10 | out: ppvObject=0x559eb10*=0x9fa0ec) returned 0x0 [0213.123] IUnknown:QueryInterface (in: This=0x5ff294c, riid=0x6ed41104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559eb0c | out: ppvObject=0x559eb0c*=0x5ff2950) returned 0x0 [0213.123] IClientSecurity:SetBlanket (This=0x5ff2950, pProxy=0x5ff294c, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0213.145] IUnknown:Release (This=0x5ff2950) returned 0x2 [0213.145] WbemLocator:IUnknown:Release (This=0x9fa0ec) returned 0x1 [0213.145] CoTaskMemFree (pv=0xa227c0) [0213.145] IUnknown:QueryInterface (in: This=0x5ff294c, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e708 | out: ppvObject=0x559e708*=0x9fa0ec) returned 0x0 [0213.145] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa0ec, riid=0x7463fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x559e6c4 | out: ppvObject=0x559e6c4*=0x0) returned 0x80004002 [0213.145] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa0ec, riid=0x7463fe90*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x559e4e4 | out: ppvObject=0x559e4e4*=0x0) returned 0x80004002 [0213.146] WbemLocator:IUnknown:AddRef (This=0x9fa0ec) returned 0x3 [0213.146] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa0ec, riid=0x7463f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x559e024 | out: ppvObject=0x559e024*=0x0) returned 0x80004002 [0213.146] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa0ec, riid=0x7463f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x559dfd4 | out: ppvObject=0x559dfd4*=0x0) returned 0x80004002 [0213.146] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa0ec, riid=0x7462c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559dfe0 | out: ppvObject=0x559dfe0*=0x9fa04c) returned 0x0 [0213.146] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x9fa04c, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x559dfe8 | out: pCid=0x559dfe8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0213.146] WbemLocator:IUnknown:Release (This=0x9fa04c) returned 0x3 [0213.146] CoGetContextToken (in: pToken=0x559e040 | out: pToken=0x559e040) returned 0x0 [0213.146] CoGetContextToken (in: pToken=0x559e448 | out: pToken=0x559e448) returned 0x0 [0213.147] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa0ec, riid=0x7463fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e4d8 | out: ppvObject=0x559e4d8*=0x9fa0d4) returned 0x0 [0213.147] WbemLocator:IRpcOptions:Query (in: This=0x9fa0d4, pPrx=0x9fa0ec, dwProperty=2, pdwValue=0x559e500 | out: pdwValue=0x559e500) returned 0x80004002 [0213.147] WbemLocator:IUnknown:Release (This=0x9fa0d4) returned 0x3 [0213.147] WbemLocator:IUnknown:Release (This=0x9fa0ec) returned 0x2 [0213.147] CoGetContextToken (in: pToken=0x559ea18 | out: pToken=0x559ea18) returned 0x0 [0213.147] CoGetContextToken (in: pToken=0x559e978 | out: pToken=0x559e978) returned 0x0 [0213.147] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa0ec, riid=0x559ea48*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x559ea44 | out: ppvObject=0x559ea44*=0x5ff294c) returned 0x0 [0213.147] IUnknown:AddRef (This=0x5ff294c) returned 0x4 [0213.147] IUnknown:Release (This=0x5ff294c) returned 0x3 [0213.147] IUnknown:Release (This=0x5ff294c) returned 0x2 [0213.147] WbemLocator:IUnknown:Release (This=0x5ff28ac) returned 0x2 [0213.147] SysStringLen (param_1=0x0) returned 0x0 [0213.147] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5fe09c0, puCount=0x559ed04 | out: puCount=0x559ed04*=0x2) returned 0x0 [0213.147] WbemDefPath:IWbemPath:GetText (in: This=0x5fe09c0, lFlags=4, puBuffLength=0x559ed00*=0x0, pszText=0x0 | out: puBuffLength=0x559ed00*=0xf, pszText=0x0) returned 0x0 [0213.147] WbemDefPath:IWbemPath:GetText (in: This=0x5fe09c0, lFlags=4, puBuffLength=0x559ed00*=0xf, pszText="00000000000000" | out: puBuffLength=0x559ed00*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0213.155] CoGetContextToken (in: pToken=0x559eaf8 | out: pToken=0x559eaf8) returned 0x0 [0213.155] IUnknown:AddRef (This=0x5ff294c) returned 0x3 [0213.155] IEnumWbemClassObject:Clone (in: This=0x5ff294c, ppEnum=0x559ecb8 | out: ppEnum=0x559ecb8*=0x5ff2a14) returned 0x0 [0213.158] IUnknown:QueryInterface (in: This=0x5ff2a14, riid=0x6ed41104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559eb7c | out: ppvObject=0x559eb7c*=0x5ff2a18) returned 0x0 [0213.158] IClientSecurity:QueryBlanket (in: This=0x5ff2a18, pProxy=0x5ff2a14, pAuthnSvc=0x559ebcc, pAuthzSvc=0x559ebc8, pServerPrincName=0x559ebc0, pAuthnLevel=0x559ebc4, pImpLevel=0x559ebb4, pAuthInfo=0x559ebb8, pCapabilites=0x559ebbc | out: pAuthnSvc=0x559ebcc*=0xa, pAuthzSvc=0x559ebc8*=0x0, pServerPrincName=0x559ebc0, pAuthnLevel=0x559ebc4*=0x6, pImpLevel=0x559ebb4*=0x2, pAuthInfo=0x559ebb8, pCapabilites=0x559ebbc*=0x1) returned 0x0 [0213.158] IUnknown:Release (This=0x5ff2a18) returned 0x1 [0213.158] IUnknown:QueryInterface (in: This=0x5ff2a14, riid=0x6ed410f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559eb70 | out: ppvObject=0x559eb70*=0x9fa77c) returned 0x0 [0213.158] IUnknown:QueryInterface (in: This=0x5ff2a14, riid=0x6ed41104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559eb6c | out: ppvObject=0x559eb6c*=0x5ff2a18) returned 0x0 [0213.158] IClientSecurity:SetBlanket (This=0x5ff2a18, pProxy=0x5ff2a14, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0213.161] IUnknown:Release (This=0x5ff2a18) returned 0x2 [0213.161] WbemLocator:IUnknown:Release (This=0x9fa77c) returned 0x1 [0213.161] CoTaskMemFree (pv=0xa22790) [0213.161] IUnknown:QueryInterface (in: This=0x5ff2a14, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e758 | out: ppvObject=0x559e758*=0x9fa77c) returned 0x0 [0213.161] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa77c, riid=0x7463fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x559e714 | out: ppvObject=0x559e714*=0x0) returned 0x80004002 [0213.165] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa77c, riid=0x7463fe90*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x559e534 | out: ppvObject=0x559e534*=0x0) returned 0x80004002 [0213.167] WbemLocator:IUnknown:AddRef (This=0x9fa77c) returned 0x3 [0213.167] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa77c, riid=0x7463f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x559e074 | out: ppvObject=0x559e074*=0x0) returned 0x80004002 [0213.173] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa77c, riid=0x7463f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x559e024 | out: ppvObject=0x559e024*=0x0) returned 0x80004002 [0213.174] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa77c, riid=0x7462c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e030 | out: ppvObject=0x559e030*=0x9fa6dc) returned 0x0 [0213.174] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x9fa6dc, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x559e038 | out: pCid=0x559e038*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0213.174] WbemLocator:IUnknown:Release (This=0x9fa6dc) returned 0x3 [0213.174] CoGetContextToken (in: pToken=0x559e090 | out: pToken=0x559e090) returned 0x0 [0213.174] CoGetContextToken (in: pToken=0x559e498 | out: pToken=0x559e498) returned 0x0 [0213.174] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa77c, riid=0x7463fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e528 | out: ppvObject=0x559e528*=0x9fa764) returned 0x0 [0213.174] WbemLocator:IRpcOptions:Query (in: This=0x9fa764, pPrx=0x9fa77c, dwProperty=2, pdwValue=0x559e550 | out: pdwValue=0x559e550) returned 0x80004002 [0213.174] WbemLocator:IUnknown:Release (This=0x9fa764) returned 0x3 [0213.174] WbemLocator:IUnknown:Release (This=0x9fa77c) returned 0x2 [0213.174] CoGetContextToken (in: pToken=0x559ea68 | out: pToken=0x559ea68) returned 0x0 [0213.174] CoGetContextToken (in: pToken=0x559e9c8 | out: pToken=0x559e9c8) returned 0x0 [0213.174] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa77c, riid=0x559ea98*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x559ea94 | out: ppvObject=0x559ea94*=0x5ff2a14) returned 0x0 [0213.174] IUnknown:AddRef (This=0x5ff2a14) returned 0x4 [0213.174] IUnknown:Release (This=0x5ff2a14) returned 0x3 [0213.174] IUnknown:Release (This=0x5ff2a14) returned 0x2 [0213.174] IUnknown:Release (This=0x5ff294c) returned 0x2 [0213.174] SysStringLen (param_1=0x0) returned 0x0 [0213.175] IEnumWbemClassObject:Reset (This=0x5ff2a14) returned 0x0 [0213.177] CoTaskMemAlloc (cb=0x4) returned 0xa35ed0 [0213.178] IEnumWbemClassObject:Next (in: This=0x5ff2a14, lTimeout=-1, uCount=0x1, apObjects=0xa35ed0, puReturned=0x24c1a3c | out: apObjects=0xa35ed0*=0x5ff2a50, puReturned=0x24c1a3c*=0x1) returned 0x0 [0217.217] IUnknown:QueryInterface (in: This=0x5ff2a50, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e320 | out: ppvObject=0x559e320*=0x5ff2a50) returned 0x0 [0217.217] IUnknown:QueryInterface (in: This=0x5ff2a50, riid=0x7463fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x559e2dc | out: ppvObject=0x559e2dc*=0x0) returned 0x80004002 [0217.217] IUnknown:QueryInterface (in: This=0x5ff2a50, riid=0x7463fe90*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x559e0fc | out: ppvObject=0x559e0fc*=0x0) returned 0x80004002 [0217.217] IUnknown:AddRef (This=0x5ff2a50) returned 0x3 [0217.218] IUnknown:QueryInterface (in: This=0x5ff2a50, riid=0x7463f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x559dc3c | out: ppvObject=0x559dc3c*=0x0) returned 0x80004002 [0217.218] IUnknown:QueryInterface (in: This=0x5ff2a50, riid=0x7463f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x559dbec | out: ppvObject=0x559dbec*=0x0) returned 0x80004002 [0217.218] IUnknown:QueryInterface (in: This=0x5ff2a50, riid=0x7462c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559dbf8 | out: ppvObject=0x559dbf8*=0x5ff2a54) returned 0x0 [0217.218] IMarshal:GetUnmarshalClass (in: This=0x5ff2a54, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x559dc00 | out: pCid=0x559dc00*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0217.218] IUnknown:Release (This=0x5ff2a54) returned 0x3 [0217.218] CoGetContextToken (in: pToken=0x559dc58 | out: pToken=0x559dc58) returned 0x0 [0217.218] CoGetContextToken (in: pToken=0x559e060 | out: pToken=0x559e060) returned 0x0 [0217.218] IUnknown:QueryInterface (in: This=0x5ff2a50, riid=0x7463fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e0f0 | out: ppvObject=0x559e0f0*=0x0) returned 0x80004002 [0217.218] IUnknown:Release (This=0x5ff2a50) returned 0x2 [0217.218] CoGetContextToken (in: pToken=0x559e630 | out: pToken=0x559e630) returned 0x0 [0217.218] CoGetContextToken (in: pToken=0x559e590 | out: pToken=0x559e590) returned 0x0 [0217.218] IUnknown:QueryInterface (in: This=0x5ff2a50, riid=0x559e660*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x559e65c | out: ppvObject=0x559e65c*=0x5ff2a50) returned 0x0 [0217.218] IUnknown:AddRef (This=0x5ff2a50) returned 0x4 [0217.218] IUnknown:Release (This=0x5ff2a50) returned 0x3 [0217.218] IUnknown:Release (This=0x5ff2a50) returned 0x2 [0217.218] CoTaskMemFree (pv=0xa35ed0) [0217.218] CoGetContextToken (in: pToken=0x559e998 | out: pToken=0x559e998) returned 0x0 [0217.218] IUnknown:AddRef (This=0x5ff2a50) returned 0x3 [0217.219] IWbemClassObject:Get (in: This=0x5ff2a50, wszName="__GENUS", lFlags=0, pVal=0x559eca8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x559ed28*=0, plFlavor=0x559ed24*=0 | out: pVal=0x559eca8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x559ed28*=3, plFlavor=0x559ed24*=64) returned 0x0 [0217.219] IWbemClassObject:Get (in: This=0x5ff2a50, wszName="__PATH", lFlags=0, pVal=0x559ec8c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x559ed10*=0, plFlavor=0x559ed0c*=0 | out: pVal=0x559ec8c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XDUWTFONO\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"", varVal2=0x0), pType=0x559ed10*=8, plFlavor=0x559ed0c*=64) returned 0x0 [0217.219] SysStringByteLen (bstr="\\\\XDUWTFONO\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x6c [0217.219] SysStringByteLen (bstr="\\\\XDUWTFONO\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x6c [0217.219] CoGetObjectContext (in: riid=0x24bbd70*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x559ecb8 | out: ppv=0x559ecb8*=0x98faac) returned 0x0 [0217.219] IComThreadingInfo:GetCurrentApartmentType (in: This=0x98faac, pAptType=0x559ecb0 | out: pAptType=0x559ecb0*=1) returned 0x0 [0217.220] IUnknown:QueryInterface (in: This=0x98faac, riid=0x24bbd58*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x559ecb4 | out: ppvObject=0x559ecb4*=0x0) returned 0x80004002 [0217.220] IUnknown:Release (This=0x98faac) returned 0x1 [0217.220] CoGetClassObject (in: rclsid=0xa2255c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7459d1fc*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x559e620 | out: ppv=0x559e620*=0x5fef790) returned 0x0 [0217.221] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fef790, riid=0x745d0ae0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x559e838 | out: ppvObject=0x559e838*=0x0) returned 0x80004002 [0217.221] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5fef790, pUnkOuter=0x0, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e84c | out: ppvObject=0x559e84c*=0x5ff27c0) returned 0x0 [0217.221] WbemDefPath:IUnknown:Release (This=0x5fef790) returned 0x0 [0217.221] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ff27c0, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e46c | out: ppvObject=0x559e46c*=0x5ff27c0) returned 0x0 [0217.221] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ff27c0, riid=0x7463fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x559e428 | out: ppvObject=0x559e428*=0x0) returned 0x80004002 [0217.221] WbemDefPath:IUnknown:AddRef (This=0x5ff27c0) returned 0x3 [0217.221] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ff27c0, riid=0x7463f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x559dd84 | out: ppvObject=0x559dd84*=0x0) returned 0x80004002 [0217.221] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ff27c0, riid=0x7463f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x559dd34 | out: ppvObject=0x559dd34*=0x0) returned 0x80004002 [0217.221] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ff27c0, riid=0x7462c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559dd40 | out: ppvObject=0x559dd40*=0xa35ed0) returned 0x0 [0217.221] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xa35ed0, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x559dd48 | out: pCid=0x559dd48*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0217.221] WbemDefPath:IUnknown:Release (This=0xa35ed0) returned 0x3 [0217.221] CoGetContextToken (in: pToken=0x559dda0 | out: pToken=0x559dda0) returned 0x0 [0217.221] CoGetContextToken (in: pToken=0x559e1a8 | out: pToken=0x559e1a8) returned 0x0 [0217.221] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ff27c0, riid=0x7463fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e238 | out: ppvObject=0x559e238*=0x0) returned 0x80004002 [0217.221] WbemDefPath:IUnknown:Release (This=0x5ff27c0) returned 0x2 [0217.221] WbemDefPath:IUnknown:Release (This=0x5ff27c0) returned 0x1 [0217.221] CoGetContextToken (in: pToken=0x559eb30 | out: pToken=0x559eb30) returned 0x0 [0217.221] CoGetContextToken (in: pToken=0x559ea90 | out: pToken=0x559ea90) returned 0x0 [0217.221] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ff27c0, riid=0x559eb60*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x559eb5c | out: ppvObject=0x559eb5c*=0x5ff27c0) returned 0x0 [0217.221] WbemDefPath:IUnknown:AddRef (This=0x5ff27c0) returned 0x3 [0217.222] WbemDefPath:IUnknown:Release (This=0x5ff27c0) returned 0x2 [0217.222] WbemDefPath:IWbemPath:SetText (This=0x5ff27c0, uMode=0x4, pszPath="\\\\XDUWTFONO\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x0 [0217.222] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5fe09c0, puCount=0x559ece4 | out: puCount=0x559ece4*=0x2) returned 0x0 [0217.222] WbemDefPath:IWbemPath:GetText (in: This=0x5fe09c0, lFlags=4, puBuffLength=0x559ece0*=0x0, pszText=0x0 | out: puBuffLength=0x559ece0*=0xf, pszText=0x0) returned 0x0 [0217.222] WbemDefPath:IWbemPath:GetText (in: This=0x5fe09c0, lFlags=4, puBuffLength=0x559ece0*=0xf, pszText="00000000000000" | out: puBuffLength=0x559ece0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0217.223] CoGetContextToken (in: pToken=0x559ebe0 | out: pToken=0x559ebe0) returned 0x0 [0217.223] WbemLocator:IUnknown:Release (This=0x9fa77c) returned 0x1 [0217.223] IUnknown:Release (This=0x5ff2a14) returned 0x0 [0217.224] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5fe09c0, puCount=0x559ed08 | out: puCount=0x559ed08*=0x2) returned 0x0 [0217.224] WbemDefPath:IWbemPath:GetText (in: This=0x5fe09c0, lFlags=4, puBuffLength=0x559ed04*=0x0, pszText=0x0 | out: puBuffLength=0x559ed04*=0xf, pszText=0x0) returned 0x0 [0217.224] WbemDefPath:IWbemPath:GetText (in: This=0x5fe09c0, lFlags=4, puBuffLength=0x559ed04*=0xf, pszText="00000000000000" | out: puBuffLength=0x559ed04*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0217.224] IWbemClassObject:Get (in: This=0x5ff2a50, wszName="Name", lFlags=0, pVal=0x559ed04*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24c22d4*=0, plFlavor=0x24c22d8*=0 | out: pVal=0x559ed04*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz", varVal2=0x0), pType=0x24c22d4*=8, plFlavor=0x24c22d8*=0) returned 0x0 [0217.224] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0217.225] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0217.225] IWbemClassObject:Get (in: This=0x5ff2a50, wszName="Name", lFlags=0, pVal=0x559ed0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24c22d4*=8, plFlavor=0x24c22d8*=0 | out: pVal=0x559ed0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz", varVal2=0x0), pType=0x24c22d4*=8, plFlavor=0x24c22d8*=0) returned 0x0 [0217.225] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0217.225] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0217.225] CoGetObjectContext (in: riid=0x24bbd70*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x559ed34 | out: ppv=0x559ed34*=0x98faac) returned 0x0 [0217.225] IComThreadingInfo:GetCurrentApartmentType (in: This=0x98faac, pAptType=0x559ed2c | out: pAptType=0x559ed2c*=1) returned 0x0 [0217.225] IUnknown:QueryInterface (in: This=0x98faac, riid=0x24bbd58*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x559ed30 | out: ppvObject=0x559ed30*=0x0) returned 0x80004002 [0217.225] IUnknown:Release (This=0x98faac) returned 0x1 [0217.226] CoGetClassObject (in: rclsid=0xa2255c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7459d1fc*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x559e6a0 | out: ppv=0x559e6a0*=0x5ff2858) returned 0x0 [0217.226] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ff2858, riid=0x745d0ae0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x559e8b8 | out: ppvObject=0x559e8b8*=0x0) returned 0x80004002 [0217.226] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5ff2858, pUnkOuter=0x0, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e8cc | out: ppvObject=0x559e8cc*=0x5ff2988) returned 0x0 [0217.226] WbemDefPath:IUnknown:Release (This=0x5ff2858) returned 0x0 [0217.226] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ff2988, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e4ec | out: ppvObject=0x559e4ec*=0x5ff2988) returned 0x0 [0217.226] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ff2988, riid=0x7463fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x559e4a8 | out: ppvObject=0x559e4a8*=0x0) returned 0x80004002 [0217.226] WbemDefPath:IUnknown:AddRef (This=0x5ff2988) returned 0x3 [0217.226] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ff2988, riid=0x7463f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x559de04 | out: ppvObject=0x559de04*=0x0) returned 0x80004002 [0217.226] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ff2988, riid=0x7463f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x559ddb4 | out: ppvObject=0x559ddb4*=0x0) returned 0x80004002 [0217.226] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ff2988, riid=0x7462c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559ddc0 | out: ppvObject=0x559ddc0*=0xa35f20) returned 0x0 [0217.226] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xa35f20, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x559ddc8 | out: pCid=0x559ddc8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0217.226] WbemDefPath:IUnknown:Release (This=0xa35f20) returned 0x3 [0217.226] CoGetContextToken (in: pToken=0x559de20 | out: pToken=0x559de20) returned 0x0 [0217.226] CoGetContextToken (in: pToken=0x559e228 | out: pToken=0x559e228) returned 0x0 [0217.226] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ff2988, riid=0x7463fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e2b8 | out: ppvObject=0x559e2b8*=0x0) returned 0x80004002 [0217.226] WbemDefPath:IUnknown:Release (This=0x5ff2988) returned 0x2 [0217.226] WbemDefPath:IUnknown:Release (This=0x5ff2988) returned 0x1 [0217.226] CoGetContextToken (in: pToken=0x559ebb0 | out: pToken=0x559ebb0) returned 0x0 [0217.226] CoGetContextToken (in: pToken=0x559eb10 | out: pToken=0x559eb10) returned 0x0 [0217.227] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ff2988, riid=0x559ebe0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x559ebdc | out: ppvObject=0x559ebdc*=0x5ff2988) returned 0x0 [0217.227] WbemDefPath:IUnknown:AddRef (This=0x5ff2988) returned 0x3 [0217.227] WbemDefPath:IUnknown:Release (This=0x5ff2988) returned 0x2 [0217.227] WbemDefPath:IWbemPath:SetText (This=0x5ff2988, uMode=0x4, pszPath="Win32_ComputerSystem") returned 0x0 [0217.227] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5ff2988, puCount=0x559ed60 | out: puCount=0x559ed60*=0x0) returned 0x0 [0217.227] WbemDefPath:IWbemPath:GetText (in: This=0x5ff2988, lFlags=2, puBuffLength=0x559ed5c*=0x0, pszText=0x0 | out: puBuffLength=0x559ed5c*=0x15, pszText=0x0) returned 0x0 [0217.227] WbemDefPath:IWbemPath:GetText (in: This=0x5ff2988, lFlags=2, puBuffLength=0x559ed5c*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x559ed5c*=0x15, pszText="Win32_ComputerSystem") returned 0x0 [0217.227] WbemDefPath:IWbemPath:GetInfo (in: This=0x5ff2988, uRequestedInfo=0x0, puResponse=0x559ed68 | out: puResponse=0x559ed68*=0xc15) returned 0x0 [0217.227] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5ff2988, puCount=0x559ed60 | out: puCount=0x559ed60*=0x0) returned 0x0 [0217.227] WbemDefPath:IWbemPath:GetInfo (in: This=0x5ff2988, uRequestedInfo=0x0, puResponse=0x559ed68 | out: puResponse=0x559ed68*=0xc15) returned 0x0 [0217.227] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5ff2988, puCount=0x559ed50 | out: puCount=0x559ed50*=0x0) returned 0x0 [0217.227] WbemDefPath:IWbemPath:GetText (in: This=0x5ff2988, lFlags=2, puBuffLength=0x559ed4c*=0x0, pszText=0x0 | out: puBuffLength=0x559ed4c*=0x15, pszText=0x0) returned 0x0 [0217.227] WbemDefPath:IWbemPath:GetText (in: This=0x5ff2988, lFlags=2, puBuffLength=0x559ed4c*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x559ed4c*=0x15, pszText="Win32_ComputerSystem") returned 0x0 [0217.227] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5ff2988, puCount=0x559ed50 | out: puCount=0x559ed50*=0x0) returned 0x0 [0217.227] WbemDefPath:IWbemPath:GetText (in: This=0x5ff2988, lFlags=2, puBuffLength=0x559ed4c*=0x0, pszText=0x0 | out: puBuffLength=0x559ed4c*=0x15, pszText=0x0) returned 0x0 [0217.227] WbemDefPath:IWbemPath:GetText (in: This=0x5ff2988, lFlags=2, puBuffLength=0x559ed4c*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x559ed4c*=0x15, pszText="Win32_ComputerSystem") returned 0x0 [0217.227] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5ff2988, puCount=0x559ece0 | out: puCount=0x559ece0*=0x0) returned 0x0 [0217.227] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5fe09c0, puCount=0x559eccc | out: puCount=0x559eccc*=0x2) returned 0x0 [0217.227] WbemDefPath:IWbemPath:GetText (in: This=0x5fe09c0, lFlags=4, puBuffLength=0x559ecc8*=0x0, pszText=0x0 | out: puBuffLength=0x559ecc8*=0xf, pszText=0x0) returned 0x0 [0217.227] WbemDefPath:IWbemPath:GetText (in: This=0x5fe09c0, lFlags=4, puBuffLength=0x559ecc8*=0xf, pszText="00000000000000" | out: puBuffLength=0x559ecc8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0217.227] CoGetObjectContext (in: riid=0x24bbd70*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x559ec7c | out: ppv=0x559ec7c*=0x98faac) returned 0x0 [0217.227] IComThreadingInfo:GetCurrentApartmentType (in: This=0x98faac, pAptType=0x559ec74 | out: pAptType=0x559ec74*=1) returned 0x0 [0217.227] IUnknown:QueryInterface (in: This=0x98faac, riid=0x24bbd58*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x559ec78 | out: ppvObject=0x559ec78*=0x0) returned 0x80004002 [0217.227] IUnknown:Release (This=0x98faac) returned 0x1 [0217.228] CoGetClassObject (in: rclsid=0xa2255c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7459d1fc*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x559e5e8 | out: ppv=0x559e5e8*=0x5fef790) returned 0x0 [0217.228] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fef790, riid=0x745d0ae0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x559e800 | out: ppvObject=0x559e800*=0x0) returned 0x80004002 [0217.228] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5fef790, pUnkOuter=0x0, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e814 | out: ppvObject=0x559e814*=0x5ff2e10) returned 0x0 [0217.228] WbemDefPath:IUnknown:Release (This=0x5fef790) returned 0x0 [0217.228] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ff2e10, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e434 | out: ppvObject=0x559e434*=0x5ff2e10) returned 0x0 [0217.228] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ff2e10, riid=0x7463fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x559e3f0 | out: ppvObject=0x559e3f0*=0x0) returned 0x80004002 [0217.228] WbemDefPath:IUnknown:AddRef (This=0x5ff2e10) returned 0x3 [0217.228] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ff2e10, riid=0x7463f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x559dd4c | out: ppvObject=0x559dd4c*=0x0) returned 0x80004002 [0217.228] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ff2e10, riid=0x7463f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x559dcfc | out: ppvObject=0x559dcfc*=0x0) returned 0x80004002 [0217.228] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ff2e10, riid=0x7462c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559dd08 | out: ppvObject=0x559dd08*=0xa35eb0) returned 0x0 [0217.228] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xa35eb0, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x559dd10 | out: pCid=0x559dd10*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0217.228] WbemDefPath:IUnknown:Release (This=0xa35eb0) returned 0x3 [0217.228] CoGetContextToken (in: pToken=0x559dd68 | out: pToken=0x559dd68) returned 0x0 [0217.229] CoGetContextToken (in: pToken=0x559e170 | out: pToken=0x559e170) returned 0x0 [0217.229] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ff2e10, riid=0x7463fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e200 | out: ppvObject=0x559e200*=0x0) returned 0x80004002 [0217.229] WbemDefPath:IUnknown:Release (This=0x5ff2e10) returned 0x2 [0217.229] WbemDefPath:IUnknown:Release (This=0x5ff2e10) returned 0x1 [0217.229] CoGetContextToken (in: pToken=0x559eaf8 | out: pToken=0x559eaf8) returned 0x0 [0217.229] CoGetContextToken (in: pToken=0x559ea58 | out: pToken=0x559ea58) returned 0x0 [0217.229] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ff2e10, riid=0x559eb28*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x559eb24 | out: ppvObject=0x559eb24*=0x5ff2e10) returned 0x0 [0217.229] WbemDefPath:IUnknown:AddRef (This=0x5ff2e10) returned 0x3 [0217.229] WbemDefPath:IUnknown:Release (This=0x5ff2e10) returned 0x2 [0217.229] WbemDefPath:IWbemPath:SetText (This=0x5ff2e10, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0217.229] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5ff2e10, puCount=0x559eca4 | out: puCount=0x559eca4*=0x2) returned 0x0 [0217.229] WbemDefPath:IWbemPath:GetText (in: This=0x5ff2e10, lFlags=4, puBuffLength=0x559eca0*=0x0, pszText=0x0 | out: puBuffLength=0x559eca0*=0xf, pszText=0x0) returned 0x0 [0217.229] WbemDefPath:IWbemPath:GetText (in: This=0x5ff2e10, lFlags=4, puBuffLength=0x559eca0*=0xf, pszText="00000000000000" | out: puBuffLength=0x559eca0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0217.229] CoGetObjectContext (in: riid=0x24bbd70*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x559eca4 | out: ppv=0x559eca4*=0x98faac) returned 0x0 [0217.229] IComThreadingInfo:GetCurrentApartmentType (in: This=0x98faac, pAptType=0x559ec9c | out: pAptType=0x559ec9c*=1) returned 0x0 [0217.229] IUnknown:QueryInterface (in: This=0x98faac, riid=0x24bbd58*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x559eca0 | out: ppvObject=0x559eca0*=0x0) returned 0x80004002 [0217.229] IUnknown:Release (This=0x98faac) returned 0x1 [0217.230] CoGetClassObject (in: rclsid=0xa2264c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7459d1fc*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x559e8c0 | out: ppv=0x559e8c0*=0x5fef458) returned 0x0 [0217.230] WbemLocator:IUnknown:QueryInterface (in: This=0x5fef458, riid=0x745d0ae0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x559ead8 | out: ppvObject=0x559ead8*=0x0) returned 0x80004002 [0217.230] WbemLocator:IClassFactory:CreateInstance (in: This=0x5fef458, pUnkOuter=0x0, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559eaec | out: ppvObject=0x559eaec*=0x5fef7a0) returned 0x0 [0217.230] WbemLocator:IUnknown:Release (This=0x5fef458) returned 0x0 [0217.230] WbemLocator:IUnknown:QueryInterface (in: This=0x5fef7a0, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e70c | out: ppvObject=0x559e70c*=0x5fef7a0) returned 0x0 [0217.230] WbemLocator:IUnknown:QueryInterface (in: This=0x5fef7a0, riid=0x7463fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x559e6c8 | out: ppvObject=0x559e6c8*=0x0) returned 0x80004002 [0217.230] WbemLocator:IUnknown:AddRef (This=0x5fef7a0) returned 0x3 [0217.230] WbemLocator:IUnknown:QueryInterface (in: This=0x5fef7a0, riid=0x7463f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x559e024 | out: ppvObject=0x559e024*=0x0) returned 0x80004002 [0217.230] WbemLocator:IUnknown:QueryInterface (in: This=0x5fef7a0, riid=0x7463f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x559dfd4 | out: ppvObject=0x559dfd4*=0x0) returned 0x80004002 [0217.230] WbemLocator:IUnknown:QueryInterface (in: This=0x5fef7a0, riid=0x7462c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559dfe0 | out: ppvObject=0x559dfe0*=0x0) returned 0x80004002 [0217.230] CoGetContextToken (in: pToken=0x559e040 | out: pToken=0x559e040) returned 0x0 [0217.230] CoGetContextToken (in: pToken=0x559e448 | out: pToken=0x559e448) returned 0x0 [0217.230] WbemLocator:IUnknown:QueryInterface (in: This=0x5fef7a0, riid=0x7463fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e4d8 | out: ppvObject=0x559e4d8*=0x0) returned 0x80004002 [0217.230] WbemLocator:IUnknown:Release (This=0x5fef7a0) returned 0x2 [0217.230] WbemLocator:IUnknown:Release (This=0x5fef7a0) returned 0x1 [0217.230] CoGetContextToken (in: pToken=0x559eab8 | out: pToken=0x559eab8) returned 0x0 [0217.230] CoGetContextToken (in: pToken=0x559ea18 | out: pToken=0x559ea18) returned 0x0 [0217.230] WbemLocator:IUnknown:QueryInterface (in: This=0x5fef7a0, riid=0x559eae8*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x559eae4 | out: ppvObject=0x559eae4*=0x5fef7a0) returned 0x0 [0217.230] WbemLocator:IUnknown:AddRef (This=0x5fef7a0) returned 0x3 [0217.230] WbemLocator:IUnknown:Release (This=0x5fef7a0) returned 0x2 [0217.231] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5ff2e10, puCount=0x559ec80 | out: puCount=0x559ec80*=0x2) returned 0x0 [0217.231] WbemDefPath:IWbemPath:GetText (in: This=0x5ff2e10, lFlags=8, puBuffLength=0x559ec7c*=0x0, pszText=0x0 | out: puBuffLength=0x559ec7c*=0xf, pszText=0x0) returned 0x0 [0217.231] WbemDefPath:IWbemPath:GetText (in: This=0x5ff2e10, lFlags=8, puBuffLength=0x559ec7c*=0xf, pszText="00000000000000" | out: puBuffLength=0x559ec7c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0217.231] CoCreateInstance (in: rclsid=0x6ed41284*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6ed412e4*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x559eb58 | out: ppv=0x559eb58*=0x5ff2a20) returned 0x0 [0217.231] WbemLocator:IWbemLocator:ConnectServer (in: This=0x5ff2a20, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x559ebec | out: ppNamespace=0x559ebec*=0x5ff4fec) returned 0x0 [0217.240] WbemLocator:IUnknown:QueryInterface (in: This=0x5ff4fec, riid=0x6ed41104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559ea88 | out: ppvObject=0x559ea88*=0x9fa84c) returned 0x0 [0217.240] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x9fa84c, pProxy=0x5ff4fec, pAuthnSvc=0x559ead8, pAuthzSvc=0x559ead4, pServerPrincName=0x559eacc, pAuthnLevel=0x559ead0, pImpLevel=0x559eac0, pAuthInfo=0x559eac4, pCapabilites=0x559eac8 | out: pAuthnSvc=0x559ead8*=0xa, pAuthzSvc=0x559ead4*=0x0, pServerPrincName=0x559eacc, pAuthnLevel=0x559ead0*=0x6, pImpLevel=0x559eac0*=0x2, pAuthInfo=0x559eac4, pCapabilites=0x559eac8*=0x1) returned 0x0 [0217.240] WbemLocator:IUnknown:Release (This=0x9fa84c) returned 0x1 [0217.241] WbemLocator:IUnknown:QueryInterface (in: This=0x5ff4fec, riid=0x6ed410f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559ea7c | out: ppvObject=0x559ea7c*=0x9fa86c) returned 0x0 [0217.241] WbemLocator:IUnknown:QueryInterface (in: This=0x5ff4fec, riid=0x6ed41104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559ea78 | out: ppvObject=0x559ea78*=0x9fa84c) returned 0x0 [0217.241] WbemLocator:IClientSecurity:SetBlanket (This=0x9fa84c, pProxy=0x5ff4fec, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0217.241] WbemLocator:IUnknown:Release (This=0x9fa84c) returned 0x2 [0217.241] WbemLocator:IUnknown:Release (This=0x9fa86c) returned 0x1 [0217.241] CoTaskMemFree (pv=0xa227f0) [0217.241] WbemLocator:IUnknown:Release (This=0x5ff2a20) returned 0x0 [0217.241] WbemLocator:IUnknown:QueryInterface (in: This=0x5ff4fec, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e678 | out: ppvObject=0x559e678*=0x9fa86c) returned 0x0 [0217.241] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa86c, riid=0x7463fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x559e634 | out: ppvObject=0x559e634*=0x0) returned 0x80004002 [0217.241] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa86c, riid=0x7463fe90*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x559e454 | out: ppvObject=0x559e454*=0x0) returned 0x80004002 [0217.242] WbemLocator:IUnknown:AddRef (This=0x9fa86c) returned 0x3 [0217.242] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa86c, riid=0x7463f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x559df94 | out: ppvObject=0x559df94*=0x0) returned 0x80004002 [0217.242] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa86c, riid=0x7463f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x559df44 | out: ppvObject=0x559df44*=0x0) returned 0x80004002 [0217.242] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa86c, riid=0x7462c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559df50 | out: ppvObject=0x559df50*=0x9fa7cc) returned 0x0 [0217.242] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x9fa7cc, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x559df58 | out: pCid=0x559df58*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0217.242] WbemLocator:IUnknown:Release (This=0x9fa7cc) returned 0x3 [0217.242] CoGetContextToken (in: pToken=0x559dfb0 | out: pToken=0x559dfb0) returned 0x0 [0217.242] CoGetContextToken (in: pToken=0x559e3b8 | out: pToken=0x559e3b8) returned 0x0 [0217.242] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa86c, riid=0x7463fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e448 | out: ppvObject=0x559e448*=0x9fa854) returned 0x0 [0217.242] WbemLocator:IRpcOptions:Query (in: This=0x9fa854, pPrx=0x9fa86c, dwProperty=2, pdwValue=0x559e470 | out: pdwValue=0x559e470) returned 0x80004002 [0217.242] WbemLocator:IUnknown:Release (This=0x9fa854) returned 0x3 [0217.242] WbemLocator:IUnknown:Release (This=0x9fa86c) returned 0x2 [0217.242] CoGetContextToken (in: pToken=0x559e988 | out: pToken=0x559e988) returned 0x0 [0217.242] CoGetContextToken (in: pToken=0x559e8e8 | out: pToken=0x559e8e8) returned 0x0 [0217.242] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa86c, riid=0x559e9b8*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x559e9b4 | out: ppvObject=0x559e9b4*=0x5ff4fec) returned 0x0 [0217.242] WbemLocator:IUnknown:AddRef (This=0x5ff4fec) returned 0x4 [0217.243] WbemLocator:IUnknown:Release (This=0x5ff4fec) returned 0x3 [0217.243] WbemLocator:IUnknown:Release (This=0x5ff4fec) returned 0x2 [0217.243] SysStringLen (param_1=0x0) returned 0x0 [0217.243] CoGetContextToken (in: pToken=0x559e9c0 | out: pToken=0x559e9c0) returned 0x0 [0217.243] WbemLocator:IUnknown:AddRef (This=0x9fa86c) returned 0x3 [0217.243] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa86c, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e854 | out: ppvObject=0x559e854*=0x9fa86c) returned 0x0 [0217.243] WbemLocator:IUnknown:Release (This=0x9fa86c) returned 0x3 [0217.243] WbemLocator:IUnknown:Release (This=0x9fa86c) returned 0x2 [0217.243] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5ff2e10, puCount=0x559ecc8 | out: puCount=0x559ecc8*=0x2) returned 0x0 [0217.243] WbemDefPath:IWbemPath:GetText (in: This=0x5ff2e10, lFlags=4, puBuffLength=0x559ecc4*=0x0, pszText=0x0 | out: puBuffLength=0x559ecc4*=0xf, pszText=0x0) returned 0x0 [0217.243] WbemDefPath:IWbemPath:GetText (in: This=0x5ff2e10, lFlags=4, puBuffLength=0x559ecc4*=0xf, pszText="00000000000000" | out: puBuffLength=0x559ecc4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0217.243] CoGetContextToken (in: pToken=0x559e938 | out: pToken=0x559e938) returned 0x0 [0217.243] WbemLocator:IUnknown:AddRef (This=0x9fa86c) returned 0x3 [0217.243] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa86c, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e7cc | out: ppvObject=0x559e7cc*=0x9fa86c) returned 0x0 [0217.243] WbemLocator:IUnknown:Release (This=0x9fa86c) returned 0x3 [0217.243] WbemLocator:IUnknown:Release (This=0x9fa86c) returned 0x2 [0217.243] WbemDefPath:IWbemPath:GetText (in: This=0x5ff2988, lFlags=2, puBuffLength=0x559eccc*=0x0, pszText=0x0 | out: puBuffLength=0x559eccc*=0x15, pszText=0x0) returned 0x0 [0217.243] WbemDefPath:IWbemPath:GetText (in: This=0x5ff2988, lFlags=2, puBuffLength=0x559eccc*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x559eccc*=0x15, pszText="Win32_ComputerSystem") returned 0x0 [0217.243] IWbemServices:GetObject (in: This=0x5ff4fec, strObjectPath="Win32_ComputerSystem", lFlags=0, pCtx=0x0, ppObject=0x559ec80*=0x0, ppCallResult=0x0 | out: ppObject=0x559ec80*=0x5ff3720, ppCallResult=0x0) returned 0x0 [0217.248] IWbemClassObject:Get (in: This=0x5ff3720, wszName="__PATH", lFlags=0, pVal=0x559ec68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x559ed10*=0, plFlavor=0x559ed0c*=0 | out: pVal=0x559ec68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XDUWTFONO\\ROOT\\cimv2:Win32_ComputerSystem", varVal2=0x0), pType=0x559ed10*=8, plFlavor=0x559ed0c*=64) returned 0x0 [0217.249] SysStringByteLen (bstr="\\\\XDUWTFONO\\ROOT\\cimv2:Win32_ComputerSystem") returned 0x56 [0217.249] SysStringByteLen (bstr="\\\\XDUWTFONO\\ROOT\\cimv2:Win32_ComputerSystem") returned 0x56 [0217.249] CoGetObjectContext (in: riid=0x24bbd70*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x559ec78 | out: ppv=0x559ec78*=0x98faac) returned 0x0 [0217.249] IComThreadingInfo:GetCurrentApartmentType (in: This=0x98faac, pAptType=0x559ec70 | out: pAptType=0x559ec70*=1) returned 0x0 [0217.249] IUnknown:QueryInterface (in: This=0x98faac, riid=0x24bbd58*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x559ec74 | out: ppvObject=0x559ec74*=0x0) returned 0x80004002 [0217.249] IUnknown:Release (This=0x98faac) returned 0x1 [0217.249] CoGetClassObject (in: rclsid=0xa2255c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7459d1fc*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x559e5e0 | out: ppv=0x559e5e0*=0x5ff2a20) returned 0x0 [0217.250] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ff2a20, riid=0x745d0ae0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x559e7f8 | out: ppvObject=0x559e7f8*=0x0) returned 0x80004002 [0217.250] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5ff2a20, pUnkOuter=0x0, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e80c | out: ppvObject=0x559e80c*=0x5ff4f28) returned 0x0 [0217.250] WbemDefPath:IUnknown:Release (This=0x5ff2a20) returned 0x0 [0217.250] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ff4f28, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e42c | out: ppvObject=0x559e42c*=0x5ff4f28) returned 0x0 [0217.250] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ff4f28, riid=0x7463fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x559e3e8 | out: ppvObject=0x559e3e8*=0x0) returned 0x80004002 [0217.250] WbemDefPath:IUnknown:AddRef (This=0x5ff4f28) returned 0x3 [0217.250] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ff4f28, riid=0x7463f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x559dd44 | out: ppvObject=0x559dd44*=0x0) returned 0x80004002 [0217.250] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ff4f28, riid=0x7463f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x559dcf4 | out: ppvObject=0x559dcf4*=0x0) returned 0x80004002 [0217.250] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ff4f28, riid=0x7462c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559dd00 | out: ppvObject=0x559dd00*=0xa35f50) returned 0x0 [0217.250] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xa35f50, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x559dd08 | out: pCid=0x559dd08*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0217.250] WbemDefPath:IUnknown:Release (This=0xa35f50) returned 0x3 [0217.250] CoGetContextToken (in: pToken=0x559dd60 | out: pToken=0x559dd60) returned 0x0 [0217.250] CoGetContextToken (in: pToken=0x559e168 | out: pToken=0x559e168) returned 0x0 [0217.250] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ff4f28, riid=0x7463fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e1f8 | out: ppvObject=0x559e1f8*=0x0) returned 0x80004002 [0217.250] WbemDefPath:IUnknown:Release (This=0x5ff4f28) returned 0x2 [0217.250] WbemDefPath:IUnknown:Release (This=0x5ff4f28) returned 0x1 [0217.250] CoGetContextToken (in: pToken=0x559eaf0 | out: pToken=0x559eaf0) returned 0x0 [0217.250] CoGetContextToken (in: pToken=0x559ea50 | out: pToken=0x559ea50) returned 0x0 [0217.250] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ff4f28, riid=0x559eb20*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x559eb1c | out: ppvObject=0x559eb1c*=0x5ff4f28) returned 0x0 [0217.250] WbemDefPath:IUnknown:AddRef (This=0x5ff4f28) returned 0x3 [0217.250] WbemDefPath:IUnknown:Release (This=0x5ff4f28) returned 0x2 [0217.250] WbemDefPath:IWbemPath:SetText (This=0x5ff4f28, uMode=0x4, pszPath="\\\\XDUWTFONO\\ROOT\\cimv2:Win32_ComputerSystem") returned 0x0 [0217.250] IWbemClassObject:Get (in: This=0x5ff3720, wszName="__CLASS", lFlags=0, pVal=0x559ecd8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x559ed58*=0, plFlavor=0x559ed54*=0 | out: pVal=0x559ecd8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_ComputerSystem", varVal2=0x0), pType=0x559ed58*=8, plFlavor=0x559ed54*=64) returned 0x0 [0217.251] SysStringByteLen (bstr="Win32_ComputerSystem") returned 0x28 [0217.251] SysStringByteLen (bstr="Win32_ComputerSystem") returned 0x28 [0217.251] CoGetContextToken (in: pToken=0x559eae8 | out: pToken=0x559eae8) returned 0x0 [0217.251] WbemLocator:IUnknown:AddRef (This=0x5ff4fec) returned 0x3 [0217.251] IWbemServices:CreateInstanceEnum (in: This=0x5ff4fec, strFilter="Win32_ComputerSystem", lFlags=17, pCtx=0x0, ppEnum=0x559ecd4 | out: ppEnum=0x559ecd4*=0x5ff39a4) returned 0x0 [0217.263] IUnknown:QueryInterface (in: This=0x5ff39a4, riid=0x6ed41104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559eb60 | out: ppvObject=0x559eb60*=0x5ff39a8) returned 0x0 [0217.263] IClientSecurity:QueryBlanket (in: This=0x5ff39a8, pProxy=0x5ff39a4, pAuthnSvc=0x559ebb0, pAuthzSvc=0x559ebac, pServerPrincName=0x559eba4, pAuthnLevel=0x559eba8, pImpLevel=0x559eb98, pAuthInfo=0x559eb9c, pCapabilites=0x559eba0 | out: pAuthnSvc=0x559ebb0*=0xa, pAuthzSvc=0x559ebac*=0x0, pServerPrincName=0x559eba4, pAuthnLevel=0x559eba8*=0x6, pImpLevel=0x559eb98*=0x2, pAuthInfo=0x559eb9c, pCapabilites=0x559eba0*=0x1) returned 0x0 [0217.263] IUnknown:Release (This=0x5ff39a8) returned 0x1 [0217.263] IUnknown:QueryInterface (in: This=0x5ff39a4, riid=0x6ed410f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559eb54 | out: ppvObject=0x559eb54*=0x9fa77c) returned 0x0 [0217.263] IUnknown:QueryInterface (in: This=0x5ff39a4, riid=0x6ed41104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559eb50 | out: ppvObject=0x559eb50*=0x5ff39a8) returned 0x0 [0217.263] IClientSecurity:SetBlanket (This=0x5ff39a8, pProxy=0x5ff39a4, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0217.264] IUnknown:Release (This=0x5ff39a8) returned 0x2 [0217.264] WbemLocator:IUnknown:Release (This=0x9fa77c) returned 0x1 [0217.264] CoTaskMemFree (pv=0xa227c0) [0217.265] IUnknown:QueryInterface (in: This=0x5ff39a4, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e748 | out: ppvObject=0x559e748*=0x9fa77c) returned 0x0 [0217.265] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa77c, riid=0x7463fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x559e704 | out: ppvObject=0x559e704*=0x0) returned 0x80004002 [0217.265] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa77c, riid=0x7463fe90*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x559e524 | out: ppvObject=0x559e524*=0x0) returned 0x80004002 [0217.265] WbemLocator:IUnknown:AddRef (This=0x9fa77c) returned 0x3 [0217.265] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa77c, riid=0x7463f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x559e064 | out: ppvObject=0x559e064*=0x0) returned 0x80004002 [0217.265] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa77c, riid=0x7463f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x559e014 | out: ppvObject=0x559e014*=0x0) returned 0x80004002 [0217.266] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa77c, riid=0x7462c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e020 | out: ppvObject=0x559e020*=0x9fa6dc) returned 0x0 [0217.266] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x9fa6dc, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x559e028 | out: pCid=0x559e028*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0217.266] WbemLocator:IUnknown:Release (This=0x9fa6dc) returned 0x3 [0217.266] CoGetContextToken (in: pToken=0x559e080 | out: pToken=0x559e080) returned 0x0 [0217.266] CoGetContextToken (in: pToken=0x559e488 | out: pToken=0x559e488) returned 0x0 [0217.266] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa77c, riid=0x7463fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e518 | out: ppvObject=0x559e518*=0x9fa764) returned 0x0 [0217.266] WbemLocator:IRpcOptions:Query (in: This=0x9fa764, pPrx=0x9fa77c, dwProperty=2, pdwValue=0x559e540 | out: pdwValue=0x559e540) returned 0x80004002 [0217.266] WbemLocator:IUnknown:Release (This=0x9fa764) returned 0x3 [0217.266] WbemLocator:IUnknown:Release (This=0x9fa77c) returned 0x2 [0217.266] CoGetContextToken (in: pToken=0x559ea58 | out: pToken=0x559ea58) returned 0x0 [0217.266] CoGetContextToken (in: pToken=0x559e9b8 | out: pToken=0x559e9b8) returned 0x0 [0217.266] WbemLocator:IUnknown:QueryInterface (in: This=0x9fa77c, riid=0x559ea88*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x559ea84 | out: ppvObject=0x559ea84*=0x5ff39a4) returned 0x0 [0217.266] IUnknown:AddRef (This=0x5ff39a4) returned 0x4 [0217.266] IUnknown:Release (This=0x5ff39a4) returned 0x3 [0217.266] IUnknown:Release (This=0x5ff39a4) returned 0x2 [0217.266] WbemLocator:IUnknown:Release (This=0x5ff4fec) returned 0x2 [0217.266] SysStringLen (param_1=0x0) returned 0x0 [0217.266] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5ff2e10, puCount=0x559ed10 | out: puCount=0x559ed10*=0x2) returned 0x0 [0217.266] WbemDefPath:IWbemPath:GetText (in: This=0x5ff2e10, lFlags=4, puBuffLength=0x559ed0c*=0x0, pszText=0x0 | out: puBuffLength=0x559ed0c*=0xf, pszText=0x0) returned 0x0 [0217.266] WbemDefPath:IWbemPath:GetText (in: This=0x5ff2e10, lFlags=4, puBuffLength=0x559ed0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x559ed0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0217.266] CoGetContextToken (in: pToken=0x559eb50 | out: pToken=0x559eb50) returned 0x0 [0217.266] IUnknown:AddRef (This=0x5ff39a4) returned 0x3 [0217.266] IEnumWbemClassObject:Clone (in: This=0x5ff39a4, ppEnum=0x559ed10 | out: ppEnum=0x559ed10*=0x5ff3a6c) returned 0x0 [0217.267] IUnknown:QueryInterface (in: This=0x5ff3a6c, riid=0x6ed41104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559ebd4 | out: ppvObject=0x559ebd4*=0x5ff3a70) returned 0x0 [0217.267] IClientSecurity:QueryBlanket (in: This=0x5ff3a70, pProxy=0x5ff3a6c, pAuthnSvc=0x559ec24, pAuthzSvc=0x559ec20, pServerPrincName=0x559ec18, pAuthnLevel=0x559ec1c, pImpLevel=0x559ec0c, pAuthInfo=0x559ec10, pCapabilites=0x559ec14 | out: pAuthnSvc=0x559ec24*=0xa, pAuthzSvc=0x559ec20*=0x0, pServerPrincName=0x559ec18, pAuthnLevel=0x559ec1c*=0x6, pImpLevel=0x559ec0c*=0x2, pAuthInfo=0x559ec10, pCapabilites=0x559ec14*=0x1) returned 0x0 [0217.267] IUnknown:Release (This=0x5ff3a70) returned 0x1 [0217.267] IUnknown:QueryInterface (in: This=0x5ff3a6c, riid=0x6ed410f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559ebc8 | out: ppvObject=0x559ebc8*=0x9faa4c) returned 0x0 [0217.267] IUnknown:QueryInterface (in: This=0x5ff3a6c, riid=0x6ed41104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559ebc4 | out: ppvObject=0x559ebc4*=0x5ff3a70) returned 0x0 [0217.267] IClientSecurity:SetBlanket (This=0x5ff3a70, pProxy=0x5ff3a6c, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0217.268] IUnknown:Release (This=0x5ff3a70) returned 0x2 [0217.268] WbemLocator:IUnknown:Release (This=0x9faa4c) returned 0x1 [0217.268] CoTaskMemFree (pv=0xa227f0) [0217.268] IUnknown:QueryInterface (in: This=0x5ff3a6c, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e7b0 | out: ppvObject=0x559e7b0*=0x9faa4c) returned 0x0 [0217.268] WbemLocator:IUnknown:QueryInterface (in: This=0x9faa4c, riid=0x7463fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x559e76c | out: ppvObject=0x559e76c*=0x0) returned 0x80004002 [0217.269] WbemLocator:IUnknown:QueryInterface (in: This=0x9faa4c, riid=0x7463fe90*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x559e58c | out: ppvObject=0x559e58c*=0x0) returned 0x80004002 [0217.269] WbemLocator:IUnknown:AddRef (This=0x9faa4c) returned 0x3 [0217.269] WbemLocator:IUnknown:QueryInterface (in: This=0x9faa4c, riid=0x7463f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x559e0cc | out: ppvObject=0x559e0cc*=0x0) returned 0x80004002 [0217.269] WbemLocator:IUnknown:QueryInterface (in: This=0x9faa4c, riid=0x7463f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x559e07c | out: ppvObject=0x559e07c*=0x0) returned 0x80004002 [0217.269] WbemLocator:IUnknown:QueryInterface (in: This=0x9faa4c, riid=0x7462c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e088 | out: ppvObject=0x559e088*=0x9fa9ac) returned 0x0 [0217.269] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x9fa9ac, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x559e090 | out: pCid=0x559e090*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0217.269] WbemLocator:IUnknown:Release (This=0x9fa9ac) returned 0x3 [0217.269] CoGetContextToken (in: pToken=0x559e0e8 | out: pToken=0x559e0e8) returned 0x0 [0217.270] CoGetContextToken (in: pToken=0x559e4f0 | out: pToken=0x559e4f0) returned 0x0 [0217.270] WbemLocator:IUnknown:QueryInterface (in: This=0x9faa4c, riid=0x7463fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e580 | out: ppvObject=0x559e580*=0x9faa34) returned 0x0 [0217.270] WbemLocator:IRpcOptions:Query (in: This=0x9faa34, pPrx=0x9faa4c, dwProperty=2, pdwValue=0x559e5a8 | out: pdwValue=0x559e5a8) returned 0x80004002 [0217.270] WbemLocator:IUnknown:Release (This=0x9faa34) returned 0x3 [0217.270] WbemLocator:IUnknown:Release (This=0x9faa4c) returned 0x2 [0217.270] CoGetContextToken (in: pToken=0x559eac0 | out: pToken=0x559eac0) returned 0x0 [0217.270] CoGetContextToken (in: pToken=0x559ea20 | out: pToken=0x559ea20) returned 0x0 [0217.270] WbemLocator:IUnknown:QueryInterface (in: This=0x9faa4c, riid=0x559eaf0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x559eaec | out: ppvObject=0x559eaec*=0x5ff3a6c) returned 0x0 [0217.270] IUnknown:AddRef (This=0x5ff3a6c) returned 0x4 [0217.270] IUnknown:Release (This=0x5ff3a6c) returned 0x3 [0217.270] IUnknown:Release (This=0x5ff3a6c) returned 0x2 [0217.270] IUnknown:Release (This=0x5ff39a4) returned 0x2 [0217.270] SysStringLen (param_1=0x0) returned 0x0 [0217.270] IEnumWbemClassObject:Reset (This=0x5ff3a6c) returned 0x0 [0217.270] CoTaskMemAlloc (cb=0x4) returned 0xa35ff0 [0217.270] IEnumWbemClassObject:Next (in: This=0x5ff3a6c, lTimeout=-1, uCount=0x1, apObjects=0xa35ff0, puReturned=0x24c3c38 | out: apObjects=0xa35ff0*=0x5ff3aa8, puReturned=0x24c3c38*=0x1) returned 0x0 [0217.320] IUnknown:QueryInterface (in: This=0x5ff3aa8, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e370 | out: ppvObject=0x559e370*=0x5ff3aa8) returned 0x0 [0217.321] IUnknown:QueryInterface (in: This=0x5ff3aa8, riid=0x7463fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x559e32c | out: ppvObject=0x559e32c*=0x0) returned 0x80004002 [0217.321] IUnknown:QueryInterface (in: This=0x5ff3aa8, riid=0x7463fe90*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x559e14c | out: ppvObject=0x559e14c*=0x0) returned 0x80004002 [0217.321] IUnknown:AddRef (This=0x5ff3aa8) returned 0x3 [0217.321] IUnknown:QueryInterface (in: This=0x5ff3aa8, riid=0x7463f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x559dc8c | out: ppvObject=0x559dc8c*=0x0) returned 0x80004002 [0217.321] IUnknown:QueryInterface (in: This=0x5ff3aa8, riid=0x7463f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x559dc3c | out: ppvObject=0x559dc3c*=0x0) returned 0x80004002 [0217.321] IUnknown:QueryInterface (in: This=0x5ff3aa8, riid=0x7462c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559dc48 | out: ppvObject=0x559dc48*=0x5ff3aac) returned 0x0 [0217.321] IMarshal:GetUnmarshalClass (in: This=0x5ff3aac, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x559dc50 | out: pCid=0x559dc50*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0217.321] IUnknown:Release (This=0x5ff3aac) returned 0x3 [0217.321] CoGetContextToken (in: pToken=0x559dca8 | out: pToken=0x559dca8) returned 0x0 [0217.321] CoGetContextToken (in: pToken=0x559e0b0 | out: pToken=0x559e0b0) returned 0x0 [0217.321] IUnknown:QueryInterface (in: This=0x5ff3aa8, riid=0x7463fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e140 | out: ppvObject=0x559e140*=0x0) returned 0x80004002 [0217.321] IUnknown:Release (This=0x5ff3aa8) returned 0x2 [0217.321] CoGetContextToken (in: pToken=0x559e680 | out: pToken=0x559e680) returned 0x0 [0217.321] CoGetContextToken (in: pToken=0x559e5e0 | out: pToken=0x559e5e0) returned 0x0 [0217.321] IUnknown:QueryInterface (in: This=0x5ff3aa8, riid=0x559e6b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x559e6ac | out: ppvObject=0x559e6ac*=0x5ff3aa8) returned 0x0 [0217.321] IUnknown:AddRef (This=0x5ff3aa8) returned 0x4 [0217.321] IUnknown:Release (This=0x5ff3aa8) returned 0x3 [0217.321] IUnknown:Release (This=0x5ff3aa8) returned 0x2 [0217.321] CoTaskMemFree (pv=0xa35ff0) [0217.321] CoGetContextToken (in: pToken=0x559e9f0 | out: pToken=0x559e9f0) returned 0x0 [0217.321] IUnknown:AddRef (This=0x5ff3aa8) returned 0x3 [0217.321] IWbemClassObject:Get (in: This=0x5ff3aa8, wszName="__GENUS", lFlags=0, pVal=0x559ed00*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x559ed80*=0, plFlavor=0x559ed7c*=0 | out: pVal=0x559ed00*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x559ed80*=3, plFlavor=0x559ed7c*=64) returned 0x0 [0217.322] IWbemClassObject:Get (in: This=0x5ff3aa8, wszName="__PATH", lFlags=0, pVal=0x559ece4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x559ed68*=0, plFlavor=0x559ed64*=0 | out: pVal=0x559ece4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XDUWTFONO\\root\\cimv2:Win32_ComputerSystem.Name=\"XDUWTFONO\"", varVal2=0x0), pType=0x559ed68*=8, plFlavor=0x559ed64*=64) returned 0x0 [0217.322] SysStringByteLen (bstr="\\\\XDUWTFONO\\root\\cimv2:Win32_ComputerSystem.Name=\"XDUWTFONO\"") returned 0x78 [0217.322] SysStringByteLen (bstr="\\\\XDUWTFONO\\root\\cimv2:Win32_ComputerSystem.Name=\"XDUWTFONO\"") returned 0x78 [0217.322] CoGetObjectContext (in: riid=0x24bbd70*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x559ed10 | out: ppv=0x559ed10*=0x98faac) returned 0x0 [0217.322] IComThreadingInfo:GetCurrentApartmentType (in: This=0x98faac, pAptType=0x559ed08 | out: pAptType=0x559ed08*=1) returned 0x0 [0217.322] IUnknown:QueryInterface (in: This=0x98faac, riid=0x24bbd58*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x559ed0c | out: ppvObject=0x559ed0c*=0x0) returned 0x80004002 [0217.322] IUnknown:Release (This=0x98faac) returned 0x1 [0217.323] CoGetClassObject (in: rclsid=0xa2255c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7459d1fc*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x559e678 | out: ppv=0x559e678*=0x5ff4f98) returned 0x0 [0217.323] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ff4f98, riid=0x745d0ae0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x559e890 | out: ppvObject=0x559e890*=0x0) returned 0x80004002 [0217.323] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5ff4f98, pUnkOuter=0x0, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e8a4 | out: ppvObject=0x559e8a4*=0x5ff3dd8) returned 0x0 [0217.323] WbemDefPath:IUnknown:Release (This=0x5ff4f98) returned 0x0 [0217.323] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ff3dd8, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e4c4 | out: ppvObject=0x559e4c4*=0x5ff3dd8) returned 0x0 [0217.323] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ff3dd8, riid=0x7463fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x559e480 | out: ppvObject=0x559e480*=0x0) returned 0x80004002 [0217.323] WbemDefPath:IUnknown:AddRef (This=0x5ff3dd8) returned 0x3 [0217.323] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ff3dd8, riid=0x7463f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x559dddc | out: ppvObject=0x559dddc*=0x0) returned 0x80004002 [0217.323] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ff3dd8, riid=0x7463f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x559dd8c | out: ppvObject=0x559dd8c*=0x0) returned 0x80004002 [0217.323] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ff3dd8, riid=0x7462c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559dd98 | out: ppvObject=0x559dd98*=0xa35ff0) returned 0x0 [0217.324] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xa35ff0, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x559dda0 | out: pCid=0x559dda0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0217.324] WbemDefPath:IUnknown:Release (This=0xa35ff0) returned 0x3 [0217.324] CoGetContextToken (in: pToken=0x559ddf8 | out: pToken=0x559ddf8) returned 0x0 [0217.324] CoGetContextToken (in: pToken=0x559e200 | out: pToken=0x559e200) returned 0x0 [0217.324] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ff3dd8, riid=0x7463fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e290 | out: ppvObject=0x559e290*=0x0) returned 0x80004002 [0217.324] WbemDefPath:IUnknown:Release (This=0x5ff3dd8) returned 0x2 [0217.324] WbemDefPath:IUnknown:Release (This=0x5ff3dd8) returned 0x1 [0217.324] CoGetContextToken (in: pToken=0x559eb88 | out: pToken=0x559eb88) returned 0x0 [0217.324] CoGetContextToken (in: pToken=0x559eae8 | out: pToken=0x559eae8) returned 0x0 [0217.324] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ff3dd8, riid=0x559ebb8*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x559ebb4 | out: ppvObject=0x559ebb4*=0x5ff3dd8) returned 0x0 [0217.324] WbemDefPath:IUnknown:AddRef (This=0x5ff3dd8) returned 0x3 [0217.324] WbemDefPath:IUnknown:Release (This=0x5ff3dd8) returned 0x2 [0217.324] WbemDefPath:IWbemPath:SetText (This=0x5ff3dd8, uMode=0x4, pszPath="\\\\XDUWTFONO\\root\\cimv2:Win32_ComputerSystem.Name=\"XDUWTFONO\"") returned 0x0 [0217.324] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5ff2e10, puCount=0x559ed3c | out: puCount=0x559ed3c*=0x2) returned 0x0 [0217.324] WbemDefPath:IWbemPath:GetText (in: This=0x5ff2e10, lFlags=4, puBuffLength=0x559ed38*=0x0, pszText=0x0 | out: puBuffLength=0x559ed38*=0xf, pszText=0x0) returned 0x0 [0217.324] WbemDefPath:IWbemPath:GetText (in: This=0x5ff2e10, lFlags=4, puBuffLength=0x559ed38*=0xf, pszText="00000000000000" | out: puBuffLength=0x559ed38*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0217.324] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5ff2e10, puCount=0x559ed1c | out: puCount=0x559ed1c*=0x2) returned 0x0 [0217.324] WbemDefPath:IWbemPath:GetText (in: This=0x5ff2e10, lFlags=4, puBuffLength=0x559ed18*=0x0, pszText=0x0 | out: puBuffLength=0x559ed18*=0xf, pszText=0x0) returned 0x0 [0217.324] WbemDefPath:IWbemPath:GetText (in: This=0x5ff2e10, lFlags=4, puBuffLength=0x559ed18*=0xf, pszText="00000000000000" | out: puBuffLength=0x559ed18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0217.324] IWbemClassObject:Get (in: This=0x5ff3aa8, wszName="TotalPhysicalMemory", lFlags=0, pVal=0x559ed18*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24c4458*=0, plFlavor=0x24c445c*=0 | out: pVal=0x559ed18*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="2146942976", varVal2=0x0), pType=0x24c4458*=21, plFlavor=0x24c445c*=0) returned 0x0 [0217.324] SysStringByteLen (bstr="2146942976") returned 0x14 [0217.324] SysStringByteLen (bstr="2146942976") returned 0x14 [0217.324] IWbemClassObject:Get (in: This=0x5ff3aa8, wszName="TotalPhysicalMemory", lFlags=0, pVal=0x559ed20*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24c4458*=21, plFlavor=0x24c445c*=0 | out: pVal=0x559ed20*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="2146942976", varVal2=0x0), pType=0x24c4458*=21, plFlavor=0x24c445c*=0) returned 0x0 [0217.325] SysStringByteLen (bstr="2146942976") returned 0x14 [0217.325] SysStringByteLen (bstr="2146942976") returned 0x14 [0217.357] VarDecInt (in: pdecIn=0x559ec38, pdecResult=0x559ea68 | out: pdecResult=0x559ea68) returned 0x0 [0217.357] CoTaskMemAlloc (cb=0x4) returned 0xa36030 [0217.357] IEnumWbemClassObject:Next (in: This=0x5ff3a6c, lTimeout=-1, uCount=0x1, apObjects=0xa36030, puReturned=0x24c3c38 | out: apObjects=0xa36030*=0x0, puReturned=0x24c3c38*=0x0) returned 0x1 [0217.358] CoTaskMemFree (pv=0xa36030) [0217.358] CoGetContextToken (in: pToken=0x559ec38 | out: pToken=0x559ec38) returned 0x0 [0217.358] WbemLocator:IUnknown:Release (This=0x9faa4c) returned 0x1 [0217.358] IUnknown:Release (This=0x5ff3a6c) returned 0x0 [0217.359] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5fe09c0, puCount=0x559ed48 | out: puCount=0x559ed48*=0x2) returned 0x0 [0217.359] WbemDefPath:IWbemPath:GetText (in: This=0x5fe09c0, lFlags=4, puBuffLength=0x559ed44*=0x0, pszText=0x0 | out: puBuffLength=0x559ed44*=0xf, pszText=0x0) returned 0x0 [0217.359] WbemDefPath:IWbemPath:GetText (in: This=0x5fe09c0, lFlags=4, puBuffLength=0x559ed44*=0xf, pszText="00000000000000" | out: puBuffLength=0x559ed44*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0217.359] CoGetObjectContext (in: riid=0x24bbd70*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x559ecd4 | out: ppv=0x559ecd4*=0x98faac) returned 0x0 [0217.359] IComThreadingInfo:GetCurrentApartmentType (in: This=0x98faac, pAptType=0x559eccc | out: pAptType=0x559eccc*=1) returned 0x0 [0217.359] IUnknown:QueryInterface (in: This=0x98faac, riid=0x24bbd58*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x559ecd0 | out: ppvObject=0x559ecd0*=0x0) returned 0x80004002 [0217.359] IUnknown:Release (This=0x98faac) returned 0x1 [0217.360] CoGetClassObject (in: rclsid=0xa2264c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7459d1fc*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x559e8f0 | out: ppv=0x559e8f0*=0x5fef548) returned 0x0 [0217.360] WbemLocator:IUnknown:QueryInterface (in: This=0x5fef548, riid=0x745d0ae0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x559eb08 | out: ppvObject=0x559eb08*=0x0) returned 0x80004002 [0217.360] WbemLocator:IClassFactory:CreateInstance (in: This=0x5fef548, pUnkOuter=0x0, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559eb1c | out: ppvObject=0x559eb1c*=0x5ff4f98) returned 0x0 [0217.360] WbemLocator:IUnknown:Release (This=0x5fef548) returned 0x0 [0217.360] WbemLocator:IUnknown:QueryInterface (in: This=0x5ff4f98, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e73c | out: ppvObject=0x559e73c*=0x5ff4f98) returned 0x0 [0217.360] WbemLocator:IUnknown:QueryInterface (in: This=0x5ff4f98, riid=0x7463fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x559e6f8 | out: ppvObject=0x559e6f8*=0x0) returned 0x80004002 [0217.360] WbemLocator:IUnknown:AddRef (This=0x5ff4f98) returned 0x3 [0217.360] WbemLocator:IUnknown:QueryInterface (in: This=0x5ff4f98, riid=0x7463f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x559e054 | out: ppvObject=0x559e054*=0x0) returned 0x80004002 [0217.360] WbemLocator:IUnknown:QueryInterface (in: This=0x5ff4f98, riid=0x7463f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x559e004 | out: ppvObject=0x559e004*=0x0) returned 0x80004002 [0217.360] WbemLocator:IUnknown:QueryInterface (in: This=0x5ff4f98, riid=0x7462c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e010 | out: ppvObject=0x559e010*=0x0) returned 0x80004002 [0217.360] CoGetContextToken (in: pToken=0x559e070 | out: pToken=0x559e070) returned 0x0 [0217.360] CoGetContextToken (in: pToken=0x559e478 | out: pToken=0x559e478) returned 0x0 [0217.360] WbemLocator:IUnknown:QueryInterface (in: This=0x5ff4f98, riid=0x7463fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e508 | out: ppvObject=0x559e508*=0x0) returned 0x80004002 [0217.360] WbemLocator:IUnknown:Release (This=0x5ff4f98) returned 0x2 [0217.361] WbemLocator:IUnknown:Release (This=0x5ff4f98) returned 0x1 [0217.361] CoGetContextToken (in: pToken=0x559eae8 | out: pToken=0x559eae8) returned 0x0 [0217.361] CoGetContextToken (in: pToken=0x559ea48 | out: pToken=0x559ea48) returned 0x0 [0217.361] WbemLocator:IUnknown:QueryInterface (in: This=0x5ff4f98, riid=0x559eb18*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x559eb14 | out: ppvObject=0x559eb14*=0x5ff4f98) returned 0x0 [0217.361] WbemLocator:IUnknown:AddRef (This=0x5ff4f98) returned 0x3 [0217.361] WbemLocator:IUnknown:Release (This=0x5ff4f98) returned 0x2 [0217.361] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5fe09c0, puCount=0x559ecb0 | out: puCount=0x559ecb0*=0x2) returned 0x0 [0217.361] WbemDefPath:IWbemPath:GetText (in: This=0x5fe09c0, lFlags=8, puBuffLength=0x559ecac*=0x0, pszText=0x0 | out: puBuffLength=0x559ecac*=0xf, pszText=0x0) returned 0x0 [0217.361] WbemDefPath:IWbemPath:GetText (in: This=0x5fe09c0, lFlags=8, puBuffLength=0x559ecac*=0xf, pszText="00000000000000" | out: puBuffLength=0x559ecac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0217.361] CoCreateInstance (in: rclsid=0x6ed41284*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6ed412e4*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x559eb88 | out: ppv=0x559eb88*=0x5ff2a20) returned 0x0 [0217.361] WbemLocator:IWbemLocator:ConnectServer (in: This=0x5ff2a20, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x559ec1c | out: ppNamespace=0x559ec1c*=0x5ff3f14) returned 0x0 [0217.370] WbemLocator:IUnknown:QueryInterface (in: This=0x5ff3f14, riid=0x6ed41104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559eab8 | out: ppvObject=0x559eab8*=0x9fab1c) returned 0x0 [0217.370] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x9fab1c, pProxy=0x5ff3f14, pAuthnSvc=0x559eb08, pAuthzSvc=0x559eb04, pServerPrincName=0x559eafc, pAuthnLevel=0x559eb00, pImpLevel=0x559eaf0, pAuthInfo=0x559eaf4, pCapabilites=0x559eaf8 | out: pAuthnSvc=0x559eb08*=0xa, pAuthzSvc=0x559eb04*=0x0, pServerPrincName=0x559eafc, pAuthnLevel=0x559eb00*=0x6, pImpLevel=0x559eaf0*=0x2, pAuthInfo=0x559eaf4, pCapabilites=0x559eaf8*=0x1) returned 0x0 [0217.370] WbemLocator:IUnknown:Release (This=0x9fab1c) returned 0x1 [0217.370] WbemLocator:IUnknown:QueryInterface (in: This=0x5ff3f14, riid=0x6ed410f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559eaac | out: ppvObject=0x559eaac*=0x9fab3c) returned 0x0 [0217.370] WbemLocator:IUnknown:QueryInterface (in: This=0x5ff3f14, riid=0x6ed41104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559eaa8 | out: ppvObject=0x559eaa8*=0x9fab1c) returned 0x0 [0217.370] WbemLocator:IClientSecurity:SetBlanket (This=0x9fab1c, pProxy=0x5ff3f14, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0217.370] WbemLocator:IUnknown:Release (This=0x9fab1c) returned 0x2 [0217.370] WbemLocator:IUnknown:Release (This=0x9fab3c) returned 0x1 [0217.370] CoTaskMemFree (pv=0xa227c0) [0217.370] WbemLocator:IUnknown:Release (This=0x5ff2a20) returned 0x0 [0217.370] WbemLocator:IUnknown:QueryInterface (in: This=0x5ff3f14, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e6a8 | out: ppvObject=0x559e6a8*=0x9fab3c) returned 0x0 [0217.370] WbemLocator:IUnknown:QueryInterface (in: This=0x9fab3c, riid=0x7463fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x559e664 | out: ppvObject=0x559e664*=0x0) returned 0x80004002 [0217.371] WbemLocator:IUnknown:QueryInterface (in: This=0x9fab3c, riid=0x7463fe90*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x559e484 | out: ppvObject=0x559e484*=0x0) returned 0x80004002 [0217.371] WbemLocator:IUnknown:AddRef (This=0x9fab3c) returned 0x3 [0217.371] WbemLocator:IUnknown:QueryInterface (in: This=0x9fab3c, riid=0x7463f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x559dfc4 | out: ppvObject=0x559dfc4*=0x0) returned 0x80004002 [0217.371] WbemLocator:IUnknown:QueryInterface (in: This=0x9fab3c, riid=0x7463f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x559df74 | out: ppvObject=0x559df74*=0x0) returned 0x80004002 [0217.371] WbemLocator:IUnknown:QueryInterface (in: This=0x9fab3c, riid=0x7462c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559df80 | out: ppvObject=0x559df80*=0x9faa9c) returned 0x0 [0217.371] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x9faa9c, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x559df88 | out: pCid=0x559df88*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0217.371] WbemLocator:IUnknown:Release (This=0x9faa9c) returned 0x3 [0217.371] CoGetContextToken (in: pToken=0x559dfe0 | out: pToken=0x559dfe0) returned 0x0 [0217.371] CoGetContextToken (in: pToken=0x559e3e8 | out: pToken=0x559e3e8) returned 0x0 [0217.372] WbemLocator:IUnknown:QueryInterface (in: This=0x9fab3c, riid=0x7463fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e478 | out: ppvObject=0x559e478*=0x9fab24) returned 0x0 [0217.372] WbemLocator:IRpcOptions:Query (in: This=0x9fab24, pPrx=0x9fab3c, dwProperty=2, pdwValue=0x559e4a0 | out: pdwValue=0x559e4a0) returned 0x80004002 [0217.372] WbemLocator:IUnknown:Release (This=0x9fab24) returned 0x3 [0217.372] WbemLocator:IUnknown:Release (This=0x9fab3c) returned 0x2 [0217.372] CoGetContextToken (in: pToken=0x559e9b8 | out: pToken=0x559e9b8) returned 0x0 [0217.372] CoGetContextToken (in: pToken=0x559e918 | out: pToken=0x559e918) returned 0x0 [0217.372] WbemLocator:IUnknown:QueryInterface (in: This=0x9fab3c, riid=0x559e9e8*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x559e9e4 | out: ppvObject=0x559e9e4*=0x5ff3f14) returned 0x0 [0217.372] WbemLocator:IUnknown:AddRef (This=0x5ff3f14) returned 0x4 [0217.372] WbemLocator:IUnknown:Release (This=0x5ff3f14) returned 0x3 [0217.372] WbemLocator:IUnknown:Release (This=0x5ff3f14) returned 0x2 [0217.372] SysStringLen (param_1=0x0) returned 0x0 [0217.372] CoGetContextToken (in: pToken=0x559e9b0 | out: pToken=0x559e9b0) returned 0x0 [0217.372] WbemLocator:IUnknown:AddRef (This=0x9fab3c) returned 0x3 [0217.372] WbemLocator:IUnknown:QueryInterface (in: This=0x9fab3c, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e844 | out: ppvObject=0x559e844*=0x9fab3c) returned 0x0 [0217.372] WbemLocator:IUnknown:Release (This=0x9fab3c) returned 0x3 [0217.372] WbemLocator:IUnknown:Release (This=0x9fab3c) returned 0x2 [0217.372] CoGetContextToken (in: pToken=0x559ea98 | out: pToken=0x559ea98) returned 0x0 [0217.372] WbemLocator:IUnknown:AddRef (This=0x5ff3f14) returned 0x3 [0217.372] IWbemServices:ExecQuery (in: This=0x5ff3f14, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_DisplayConfiguration", lFlags=16, pCtx=0x0, ppEnum=0x559ecb8 | out: ppEnum=0x559ecb8*=0x5ff3a6c) returned 0x0 [0217.376] IUnknown:QueryInterface (in: This=0x5ff3a6c, riid=0x6ed41104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559eb08 | out: ppvObject=0x559eb08*=0x5ff3a70) returned 0x0 [0217.376] IClientSecurity:QueryBlanket (in: This=0x5ff3a70, pProxy=0x5ff3a6c, pAuthnSvc=0x559eb58, pAuthzSvc=0x559eb54, pServerPrincName=0x559eb4c, pAuthnLevel=0x559eb50, pImpLevel=0x559eb40, pAuthInfo=0x559eb44, pCapabilites=0x559eb48 | out: pAuthnSvc=0x559eb58*=0xa, pAuthzSvc=0x559eb54*=0x0, pServerPrincName=0x559eb4c, pAuthnLevel=0x559eb50*=0x6, pImpLevel=0x559eb40*=0x2, pAuthInfo=0x559eb44, pCapabilites=0x559eb48*=0x1) returned 0x0 [0217.376] IUnknown:Release (This=0x5ff3a70) returned 0x1 [0217.376] IUnknown:QueryInterface (in: This=0x5ff3a6c, riid=0x6ed410f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559eafc | out: ppvObject=0x559eafc*=0x9faa4c) returned 0x0 [0217.376] IUnknown:QueryInterface (in: This=0x5ff3a6c, riid=0x6ed41104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559eaf8 | out: ppvObject=0x559eaf8*=0x5ff3a70) returned 0x0 [0217.377] IClientSecurity:SetBlanket (This=0x5ff3a70, pProxy=0x5ff3a6c, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0217.385] IUnknown:Release (This=0x5ff3a70) returned 0x2 [0217.385] WbemLocator:IUnknown:Release (This=0x9faa4c) returned 0x1 [0217.385] CoTaskMemFree (pv=0xa227f0) [0217.385] IUnknown:QueryInterface (in: This=0x5ff3a6c, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e6f4 | out: ppvObject=0x559e6f4*=0x9faa4c) returned 0x0 [0217.385] WbemLocator:IUnknown:QueryInterface (in: This=0x9faa4c, riid=0x7463fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x559e6b0 | out: ppvObject=0x559e6b0*=0x0) returned 0x80004002 [0217.385] WbemLocator:IUnknown:QueryInterface (in: This=0x9faa4c, riid=0x7463fe90*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x559e4cc | out: ppvObject=0x559e4cc*=0x0) returned 0x80004002 [0217.386] WbemLocator:IUnknown:AddRef (This=0x9faa4c) returned 0x3 [0217.386] WbemLocator:IUnknown:QueryInterface (in: This=0x9faa4c, riid=0x7463f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x559e00c | out: ppvObject=0x559e00c*=0x0) returned 0x80004002 [0217.386] WbemLocator:IUnknown:QueryInterface (in: This=0x9faa4c, riid=0x7463f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x559dfbc | out: ppvObject=0x559dfbc*=0x0) returned 0x80004002 [0217.386] WbemLocator:IUnknown:QueryInterface (in: This=0x9faa4c, riid=0x7462c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559dfc8 | out: ppvObject=0x559dfc8*=0x9fa9ac) returned 0x0 [0217.386] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x9fa9ac, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x559dfd0 | out: pCid=0x559dfd0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0217.386] WbemLocator:IUnknown:Release (This=0x9fa9ac) returned 0x3 [0217.386] CoGetContextToken (in: pToken=0x559e028 | out: pToken=0x559e028) returned 0x0 [0217.386] CoGetContextToken (in: pToken=0x559e430 | out: pToken=0x559e430) returned 0x0 [0217.386] WbemLocator:IUnknown:QueryInterface (in: This=0x9faa4c, riid=0x7463fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e4c0 | out: ppvObject=0x559e4c0*=0x9faa34) returned 0x0 [0217.386] WbemLocator:IRpcOptions:Query (in: This=0x9faa34, pPrx=0x9faa4c, dwProperty=2, pdwValue=0x559e4e8 | out: pdwValue=0x559e4e8) returned 0x80004002 [0217.386] WbemLocator:IUnknown:Release (This=0x9faa34) returned 0x3 [0217.386] WbemLocator:IUnknown:Release (This=0x9faa4c) returned 0x2 [0217.387] CoGetContextToken (in: pToken=0x559ea08 | out: pToken=0x559ea08) returned 0x0 [0217.387] CoGetContextToken (in: pToken=0x559e968 | out: pToken=0x559e968) returned 0x0 [0217.387] WbemLocator:IUnknown:QueryInterface (in: This=0x9faa4c, riid=0x559ea38*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x559ea34 | out: ppvObject=0x559ea34*=0x5ff3a6c) returned 0x0 [0217.387] IUnknown:AddRef (This=0x5ff3a6c) returned 0x4 [0217.387] IUnknown:Release (This=0x5ff3a6c) returned 0x3 [0217.387] IUnknown:Release (This=0x5ff3a6c) returned 0x2 [0217.387] WbemLocator:IUnknown:Release (This=0x5ff3f14) returned 0x2 [0217.387] SysStringLen (param_1=0x0) returned 0x0 [0217.387] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5fe09c0, puCount=0x559ed04 | out: puCount=0x559ed04*=0x2) returned 0x0 [0217.387] WbemDefPath:IWbemPath:GetText (in: This=0x5fe09c0, lFlags=4, puBuffLength=0x559ed00*=0x0, pszText=0x0 | out: puBuffLength=0x559ed00*=0xf, pszText=0x0) returned 0x0 [0217.387] WbemDefPath:IWbemPath:GetText (in: This=0x5fe09c0, lFlags=4, puBuffLength=0x559ed00*=0xf, pszText="00000000000000" | out: puBuffLength=0x559ed00*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0217.387] CoGetContextToken (in: pToken=0x559eb50 | out: pToken=0x559eb50) returned 0x0 [0217.387] IUnknown:AddRef (This=0x5ff3a6c) returned 0x3 [0217.387] IEnumWbemClassObject:Clone (in: This=0x5ff3a6c, ppEnum=0x559ed10 | out: ppEnum=0x559ed10*=0x60021a4) returned 0x0 [0217.387] IUnknown:QueryInterface (in: This=0x60021a4, riid=0x6ed41104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559ebd4 | out: ppvObject=0x559ebd4*=0x60021a8) returned 0x0 [0217.387] IClientSecurity:QueryBlanket (in: This=0x60021a8, pProxy=0x60021a4, pAuthnSvc=0x559ec24, pAuthzSvc=0x559ec20, pServerPrincName=0x559ec18, pAuthnLevel=0x559ec1c, pImpLevel=0x559ec0c, pAuthInfo=0x559ec10, pCapabilites=0x559ec14 | out: pAuthnSvc=0x559ec24*=0xa, pAuthzSvc=0x559ec20*=0x0, pServerPrincName=0x559ec18, pAuthnLevel=0x559ec1c*=0x6, pImpLevel=0x559ec0c*=0x2, pAuthInfo=0x559ec10, pCapabilites=0x559ec14*=0x1) returned 0x0 [0217.388] IUnknown:Release (This=0x60021a8) returned 0x1 [0217.388] IUnknown:QueryInterface (in: This=0x60021a4, riid=0x6ed410f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559ebc8 | out: ppvObject=0x559ebc8*=0x9fad1c) returned 0x0 [0217.388] IUnknown:QueryInterface (in: This=0x60021a4, riid=0x6ed41104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559ebc4 | out: ppvObject=0x559ebc4*=0x60021a8) returned 0x0 [0217.388] IClientSecurity:SetBlanket (This=0x60021a8, pProxy=0x60021a4, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0217.389] IUnknown:Release (This=0x60021a8) returned 0x2 [0217.389] WbemLocator:IUnknown:Release (This=0x9fad1c) returned 0x1 [0217.389] CoTaskMemFree (pv=0xa227c0) [0217.389] IUnknown:QueryInterface (in: This=0x60021a4, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e7b0 | out: ppvObject=0x559e7b0*=0x9fad1c) returned 0x0 [0217.389] WbemLocator:IUnknown:QueryInterface (in: This=0x9fad1c, riid=0x7463fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x559e76c | out: ppvObject=0x559e76c*=0x0) returned 0x80004002 [0217.389] WbemLocator:IUnknown:QueryInterface (in: This=0x9fad1c, riid=0x7463fe90*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x559e58c | out: ppvObject=0x559e58c*=0x0) returned 0x80004002 [0217.389] WbemLocator:IUnknown:AddRef (This=0x9fad1c) returned 0x3 [0217.389] WbemLocator:IUnknown:QueryInterface (in: This=0x9fad1c, riid=0x7463f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x559e0cc | out: ppvObject=0x559e0cc*=0x0) returned 0x80004002 [0217.390] WbemLocator:IUnknown:QueryInterface (in: This=0x9fad1c, riid=0x7463f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x559e07c | out: ppvObject=0x559e07c*=0x0) returned 0x80004002 [0217.390] WbemLocator:IUnknown:QueryInterface (in: This=0x9fad1c, riid=0x7462c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e088 | out: ppvObject=0x559e088*=0x9fac7c) returned 0x0 [0217.390] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x9fac7c, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x559e090 | out: pCid=0x559e090*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0217.390] WbemLocator:IUnknown:Release (This=0x9fac7c) returned 0x3 [0217.390] CoGetContextToken (in: pToken=0x559e0e8 | out: pToken=0x559e0e8) returned 0x0 [0217.390] CoGetContextToken (in: pToken=0x559e4f0 | out: pToken=0x559e4f0) returned 0x0 [0217.390] WbemLocator:IUnknown:QueryInterface (in: This=0x9fad1c, riid=0x7463fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e580 | out: ppvObject=0x559e580*=0x9fad04) returned 0x0 [0217.390] WbemLocator:IRpcOptions:Query (in: This=0x9fad04, pPrx=0x9fad1c, dwProperty=2, pdwValue=0x559e5a8 | out: pdwValue=0x559e5a8) returned 0x80004002 [0217.390] WbemLocator:IUnknown:Release (This=0x9fad04) returned 0x3 [0217.390] WbemLocator:IUnknown:Release (This=0x9fad1c) returned 0x2 [0217.390] CoGetContextToken (in: pToken=0x559eac0 | out: pToken=0x559eac0) returned 0x0 [0217.390] CoGetContextToken (in: pToken=0x559ea20 | out: pToken=0x559ea20) returned 0x0 [0217.390] WbemLocator:IUnknown:QueryInterface (in: This=0x9fad1c, riid=0x559eaf0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x559eaec | out: ppvObject=0x559eaec*=0x60021a4) returned 0x0 [0217.390] IUnknown:AddRef (This=0x60021a4) returned 0x4 [0217.390] IUnknown:Release (This=0x60021a4) returned 0x3 [0217.390] IUnknown:Release (This=0x60021a4) returned 0x2 [0217.390] IUnknown:Release (This=0x5ff3a6c) returned 0x2 [0217.390] SysStringLen (param_1=0x0) returned 0x0 [0217.390] IEnumWbemClassObject:Reset (This=0x60021a4) returned 0x0 [0217.391] CoTaskMemAlloc (cb=0x4) returned 0xa36070 [0217.391] IEnumWbemClassObject:Next (in: This=0x60021a4, lTimeout=-1, uCount=0x1, apObjects=0xa36070, puReturned=0x24c51d0 | out: apObjects=0xa36070*=0x60021e0, puReturned=0x24c51d0*=0x1) returned 0x0 [0217.424] IUnknown:QueryInterface (in: This=0x60021e0, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e370 | out: ppvObject=0x559e370*=0x60021e0) returned 0x0 [0217.424] IUnknown:QueryInterface (in: This=0x60021e0, riid=0x7463fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x559e32c | out: ppvObject=0x559e32c*=0x0) returned 0x80004002 [0217.424] IUnknown:QueryInterface (in: This=0x60021e0, riid=0x7463fe90*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x559e14c | out: ppvObject=0x559e14c*=0x0) returned 0x80004002 [0217.424] IUnknown:AddRef (This=0x60021e0) returned 0x3 [0217.424] IUnknown:QueryInterface (in: This=0x60021e0, riid=0x7463f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x559dc8c | out: ppvObject=0x559dc8c*=0x0) returned 0x80004002 [0217.424] IUnknown:QueryInterface (in: This=0x60021e0, riid=0x7463f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x559dc3c | out: ppvObject=0x559dc3c*=0x0) returned 0x80004002 [0217.424] IUnknown:QueryInterface (in: This=0x60021e0, riid=0x7462c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559dc48 | out: ppvObject=0x559dc48*=0x60021e4) returned 0x0 [0217.424] IMarshal:GetUnmarshalClass (in: This=0x60021e4, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x559dc50 | out: pCid=0x559dc50*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0217.424] IUnknown:Release (This=0x60021e4) returned 0x3 [0217.424] CoGetContextToken (in: pToken=0x559dca8 | out: pToken=0x559dca8) returned 0x0 [0217.424] CoGetContextToken (in: pToken=0x559e0b0 | out: pToken=0x559e0b0) returned 0x0 [0217.424] IUnknown:QueryInterface (in: This=0x60021e0, riid=0x7463fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e140 | out: ppvObject=0x559e140*=0x0) returned 0x80004002 [0217.424] IUnknown:Release (This=0x60021e0) returned 0x2 [0217.424] CoGetContextToken (in: pToken=0x559e680 | out: pToken=0x559e680) returned 0x0 [0217.424] CoGetContextToken (in: pToken=0x559e5e0 | out: pToken=0x559e5e0) returned 0x0 [0217.424] IUnknown:QueryInterface (in: This=0x60021e0, riid=0x559e6b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x559e6ac | out: ppvObject=0x559e6ac*=0x60021e0) returned 0x0 [0217.425] IUnknown:AddRef (This=0x60021e0) returned 0x4 [0217.425] IUnknown:Release (This=0x60021e0) returned 0x3 [0217.425] IUnknown:Release (This=0x60021e0) returned 0x2 [0217.425] CoTaskMemFree (pv=0xa36070) [0217.425] CoGetContextToken (in: pToken=0x559e9f0 | out: pToken=0x559e9f0) returned 0x0 [0217.425] IUnknown:AddRef (This=0x60021e0) returned 0x3 [0217.425] IWbemClassObject:Get (in: This=0x60021e0, wszName="__GENUS", lFlags=0, pVal=0x559ed00*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x559ed80*=0, plFlavor=0x559ed7c*=0 | out: pVal=0x559ed00*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x559ed80*=3, plFlavor=0x559ed7c*=64) returned 0x0 [0217.425] IWbemClassObject:Get (in: This=0x60021e0, wszName="__PATH", lFlags=0, pVal=0x559ece4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x559ed68*=0, plFlavor=0x559ed64*=0 | out: pVal=0x559ece4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XDUWTFONO\\root\\cimv2:Win32_DisplayConfiguration.DeviceName=\"Standard VGA Graphics Adapter\"", varVal2=0x0), pType=0x559ed68*=8, plFlavor=0x559ed64*=64) returned 0x0 [0217.425] SysStringByteLen (bstr="\\\\XDUWTFONO\\root\\cimv2:Win32_DisplayConfiguration.DeviceName=\"Standard VGA Graphics Adapter\"") returned 0xb8 [0217.425] SysStringByteLen (bstr="\\\\XDUWTFONO\\root\\cimv2:Win32_DisplayConfiguration.DeviceName=\"Standard VGA Graphics Adapter\"") returned 0xb8 [0217.425] CoGetObjectContext (in: riid=0x24bbd70*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x559ed10 | out: ppv=0x559ed10*=0x98faac) returned 0x0 [0217.425] IComThreadingInfo:GetCurrentApartmentType (in: This=0x98faac, pAptType=0x559ed08 | out: pAptType=0x559ed08*=1) returned 0x0 [0217.425] IUnknown:QueryInterface (in: This=0x98faac, riid=0x24bbd58*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x559ed0c | out: ppvObject=0x559ed0c*=0x0) returned 0x80004002 [0217.425] IUnknown:Release (This=0x98faac) returned 0x1 [0217.426] CoGetClassObject (in: rclsid=0xa2255c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7459d1fc*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x559e678 | out: ppv=0x559e678*=0x6002fc8) returned 0x0 [0217.426] WbemDefPath:IUnknown:QueryInterface (in: This=0x6002fc8, riid=0x745d0ae0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x559e890 | out: ppvObject=0x559e890*=0x0) returned 0x80004002 [0217.426] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6002fc8, pUnkOuter=0x0, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e8a4 | out: ppvObject=0x559e8a4*=0x5ffca70) returned 0x0 [0217.426] WbemDefPath:IUnknown:Release (This=0x6002fc8) returned 0x0 [0217.426] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ffca70, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e4c4 | out: ppvObject=0x559e4c4*=0x5ffca70) returned 0x0 [0217.426] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ffca70, riid=0x7463fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x559e480 | out: ppvObject=0x559e480*=0x0) returned 0x80004002 [0217.426] WbemDefPath:IUnknown:AddRef (This=0x5ffca70) returned 0x3 [0217.426] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ffca70, riid=0x7463f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x559dddc | out: ppvObject=0x559dddc*=0x0) returned 0x80004002 [0217.426] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ffca70, riid=0x7463f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x559dd8c | out: ppvObject=0x559dd8c*=0x0) returned 0x80004002 [0217.426] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ffca70, riid=0x7462c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559dd98 | out: ppvObject=0x559dd98*=0xa36070) returned 0x0 [0217.426] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xa36070, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x559dda0 | out: pCid=0x559dda0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0217.427] WbemDefPath:IUnknown:Release (This=0xa36070) returned 0x3 [0217.427] CoGetContextToken (in: pToken=0x559ddf8 | out: pToken=0x559ddf8) returned 0x0 [0217.427] CoGetContextToken (in: pToken=0x559e200 | out: pToken=0x559e200) returned 0x0 [0217.427] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ffca70, riid=0x7463fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e290 | out: ppvObject=0x559e290*=0x0) returned 0x80004002 [0217.427] WbemDefPath:IUnknown:Release (This=0x5ffca70) returned 0x2 [0217.427] WbemDefPath:IUnknown:Release (This=0x5ffca70) returned 0x1 [0217.427] CoGetContextToken (in: pToken=0x559eb88 | out: pToken=0x559eb88) returned 0x0 [0217.427] CoGetContextToken (in: pToken=0x559eae8 | out: pToken=0x559eae8) returned 0x0 [0217.427] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ffca70, riid=0x559ebb8*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x559ebb4 | out: ppvObject=0x559ebb4*=0x5ffca70) returned 0x0 [0217.427] WbemDefPath:IUnknown:AddRef (This=0x5ffca70) returned 0x3 [0217.427] WbemDefPath:IUnknown:Release (This=0x5ffca70) returned 0x2 [0217.427] WbemDefPath:IWbemPath:SetText (This=0x5ffca70, uMode=0x4, pszPath="\\\\XDUWTFONO\\root\\cimv2:Win32_DisplayConfiguration.DeviceName=\"Standard VGA Graphics Adapter\"") returned 0x0 [0217.427] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5fe09c0, puCount=0x559ed3c | out: puCount=0x559ed3c*=0x2) returned 0x0 [0217.427] WbemDefPath:IWbemPath:GetText (in: This=0x5fe09c0, lFlags=4, puBuffLength=0x559ed38*=0x0, pszText=0x0 | out: puBuffLength=0x559ed38*=0xf, pszText=0x0) returned 0x0 [0217.427] WbemDefPath:IWbemPath:GetText (in: This=0x5fe09c0, lFlags=4, puBuffLength=0x559ed38*=0xf, pszText="00000000000000" | out: puBuffLength=0x559ed38*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0217.427] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5fe09c0, puCount=0x559ed08 | out: puCount=0x559ed08*=0x2) returned 0x0 [0217.427] WbemDefPath:IWbemPath:GetText (in: This=0x5fe09c0, lFlags=4, puBuffLength=0x559ed04*=0x0, pszText=0x0 | out: puBuffLength=0x559ed04*=0xf, pszText=0x0) returned 0x0 [0217.427] WbemDefPath:IWbemPath:GetText (in: This=0x5fe09c0, lFlags=4, puBuffLength=0x559ed04*=0xf, pszText="00000000000000" | out: puBuffLength=0x559ed04*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0217.427] IWbemClassObject:Get (in: This=0x60021e0, wszName="Description", lFlags=0, pVal=0x559ed04*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24c5a30*=0, plFlavor=0x24c5a34*=0 | out: pVal=0x559ed04*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Standard VGA Graphics Adapter", varVal2=0x0), pType=0x24c5a30*=8, plFlavor=0x24c5a34*=0) returned 0x0 [0217.427] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0217.427] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0217.427] IWbemClassObject:Get (in: This=0x60021e0, wszName="Description", lFlags=0, pVal=0x559ed0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24c5a30*=8, plFlavor=0x24c5a34*=0 | out: pVal=0x559ed0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Standard VGA Graphics Adapter", varVal2=0x0), pType=0x24c5a30*=8, plFlavor=0x24c5a34*=0) returned 0x0 [0217.427] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0217.427] SysStringByteLen (bstr="Standard VGA Graphics Adapter") returned 0x3a [0217.428] CoTaskMemAlloc (cb=0x4) returned 0xa360b0 [0217.428] IEnumWbemClassObject:Next (in: This=0x60021a4, lTimeout=-1, uCount=0x1, apObjects=0xa360b0, puReturned=0x24c51d0 | out: apObjects=0xa360b0*=0x0, puReturned=0x24c51d0*=0x0) returned 0x1 [0217.429] CoTaskMemFree (pv=0xa360b0) [0217.429] CoGetContextToken (in: pToken=0x559ec38 | out: pToken=0x559ec38) returned 0x0 [0217.429] WbemLocator:IUnknown:Release (This=0x9fad1c) returned 0x1 [0217.429] IUnknown:Release (This=0x60021a4) returned 0x0 [0217.430] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Enum\\DISPLAY", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ed4c | out: phkResult=0x559ed4c*=0x308) returned 0x0 [0217.430] RegQueryInfoKeyW (in: hKey=0x308, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x559ed74, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x559ed70, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x559ed74*=0x1, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x559ed70*=0x0, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0217.430] RegEnumKeyExW (in: hKey=0x308, dwIndex=0x0, lpName=0x24c5d30, lpcchName=0x559ed90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Default_Monitor", lpcchName=0x559ed90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0217.430] CoGetObjectContext (in: riid=0x24bbd70*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x559ed2c | out: ppv=0x559ed2c*=0x98faac) returned 0x0 [0217.430] IComThreadingInfo:GetCurrentApartmentType (in: This=0x98faac, pAptType=0x559ed24 | out: pAptType=0x559ed24*=1) returned 0x0 [0217.430] IUnknown:QueryInterface (in: This=0x98faac, riid=0x24bbd58*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x559ed28 | out: ppvObject=0x559ed28*=0x0) returned 0x80004002 [0217.430] IUnknown:Release (This=0x98faac) returned 0x1 [0217.431] CoGetClassObject (in: rclsid=0xa2255c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7459d1fc*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x559e698 | out: ppv=0x559e698*=0x6002fc8) returned 0x0 [0217.431] WbemDefPath:IUnknown:QueryInterface (in: This=0x6002fc8, riid=0x745d0ae0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x559e8b0 | out: ppvObject=0x559e8b0*=0x0) returned 0x80004002 [0217.431] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6002fc8, pUnkOuter=0x0, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e8c4 | out: ppvObject=0x559e8c4*=0x6002118) returned 0x0 [0217.431] WbemDefPath:IUnknown:Release (This=0x6002fc8) returned 0x0 [0217.431] WbemDefPath:IUnknown:QueryInterface (in: This=0x6002118, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e4e4 | out: ppvObject=0x559e4e4*=0x6002118) returned 0x0 [0217.431] WbemDefPath:IUnknown:QueryInterface (in: This=0x6002118, riid=0x7463fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x559e4a0 | out: ppvObject=0x559e4a0*=0x0) returned 0x80004002 [0217.431] WbemDefPath:IUnknown:AddRef (This=0x6002118) returned 0x3 [0217.431] WbemDefPath:IUnknown:QueryInterface (in: This=0x6002118, riid=0x7463f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x559ddfc | out: ppvObject=0x559ddfc*=0x0) returned 0x80004002 [0217.431] WbemDefPath:IUnknown:QueryInterface (in: This=0x6002118, riid=0x7463f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x559ddac | out: ppvObject=0x559ddac*=0x0) returned 0x80004002 [0217.431] WbemDefPath:IUnknown:QueryInterface (in: This=0x6002118, riid=0x7462c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559ddb8 | out: ppvObject=0x559ddb8*=0xa360b0) returned 0x0 [0217.431] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xa360b0, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x559ddc0 | out: pCid=0x559ddc0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0217.431] WbemDefPath:IUnknown:Release (This=0xa360b0) returned 0x3 [0217.431] CoGetContextToken (in: pToken=0x559de18 | out: pToken=0x559de18) returned 0x0 [0217.431] CoGetContextToken (in: pToken=0x559e220 | out: pToken=0x559e220) returned 0x0 [0217.431] WbemDefPath:IUnknown:QueryInterface (in: This=0x6002118, riid=0x7463fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e2b0 | out: ppvObject=0x559e2b0*=0x0) returned 0x80004002 [0217.431] WbemDefPath:IUnknown:Release (This=0x6002118) returned 0x2 [0217.432] WbemDefPath:IUnknown:Release (This=0x6002118) returned 0x1 [0217.432] CoGetContextToken (in: pToken=0x559eba8 | out: pToken=0x559eba8) returned 0x0 [0217.432] CoGetContextToken (in: pToken=0x559eb08 | out: pToken=0x559eb08) returned 0x0 [0217.432] WbemDefPath:IUnknown:QueryInterface (in: This=0x6002118, riid=0x559ebd8*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x559ebd4 | out: ppvObject=0x559ebd4*=0x6002118) returned 0x0 [0217.432] WbemDefPath:IUnknown:AddRef (This=0x6002118) returned 0x3 [0217.432] WbemDefPath:IUnknown:Release (This=0x6002118) returned 0x2 [0217.432] WbemDefPath:IWbemPath:SetText (This=0x6002118, uMode=0x4, pszPath="root\\CIMV2") returned 0x0 [0217.432] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6002118, puCount=0x559ed54 | out: puCount=0x559ed54*=0x2) returned 0x0 [0217.432] WbemDefPath:IWbemPath:GetText (in: This=0x6002118, lFlags=4, puBuffLength=0x559ed50*=0x0, pszText=0x0 | out: puBuffLength=0x559ed50*=0xf, pszText=0x0) returned 0x0 [0217.432] WbemDefPath:IWbemPath:GetText (in: This=0x6002118, lFlags=4, puBuffLength=0x559ed50*=0xf, pszText="00000000000000" | out: puBuffLength=0x559ed50*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0217.432] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6002118, puCount=0x559ed40 | out: puCount=0x559ed40*=0x2) returned 0x0 [0217.432] WbemDefPath:IWbemPath:GetText (in: This=0x6002118, lFlags=4, puBuffLength=0x559ed3c*=0x0, pszText=0x0 | out: puBuffLength=0x559ed3c*=0xf, pszText=0x0) returned 0x0 [0217.432] WbemDefPath:IWbemPath:GetText (in: This=0x6002118, lFlags=4, puBuffLength=0x559ed3c*=0xf, pszText="00000000000000" | out: puBuffLength=0x559ed3c*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0217.432] CoGetObjectContext (in: riid=0x24bbd70*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x559ecd4 | out: ppv=0x559ecd4*=0x98faac) returned 0x0 [0217.432] IComThreadingInfo:GetCurrentApartmentType (in: This=0x98faac, pAptType=0x559eccc | out: pAptType=0x559eccc*=1) returned 0x0 [0217.432] IUnknown:QueryInterface (in: This=0x98faac, riid=0x24bbd58*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x559ecd0 | out: ppvObject=0x559ecd0*=0x0) returned 0x80004002 [0217.432] IUnknown:Release (This=0x98faac) returned 0x1 [0217.433] CoGetClassObject (in: rclsid=0xa2264c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7459d1fc*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x559e8f0 | out: ppv=0x559e8f0*=0x5fef620) returned 0x0 [0217.433] WbemLocator:IUnknown:QueryInterface (in: This=0x5fef620, riid=0x745d0ae0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x559eb08 | out: ppvObject=0x559eb08*=0x0) returned 0x80004002 [0217.433] WbemLocator:IClassFactory:CreateInstance (in: This=0x5fef620, pUnkOuter=0x0, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559eb1c | out: ppvObject=0x559eb1c*=0x6002fd8) returned 0x0 [0217.433] WbemLocator:IUnknown:Release (This=0x5fef620) returned 0x0 [0217.433] WbemLocator:IUnknown:QueryInterface (in: This=0x6002fd8, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e73c | out: ppvObject=0x559e73c*=0x6002fd8) returned 0x0 [0217.433] WbemLocator:IUnknown:QueryInterface (in: This=0x6002fd8, riid=0x7463fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x559e6f8 | out: ppvObject=0x559e6f8*=0x0) returned 0x80004002 [0217.433] WbemLocator:IUnknown:AddRef (This=0x6002fd8) returned 0x3 [0217.433] WbemLocator:IUnknown:QueryInterface (in: This=0x6002fd8, riid=0x7463f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x559e054 | out: ppvObject=0x559e054*=0x0) returned 0x80004002 [0217.433] WbemLocator:IUnknown:QueryInterface (in: This=0x6002fd8, riid=0x7463f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x559e004 | out: ppvObject=0x559e004*=0x0) returned 0x80004002 [0217.433] WbemLocator:IUnknown:QueryInterface (in: This=0x6002fd8, riid=0x7462c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e010 | out: ppvObject=0x559e010*=0x0) returned 0x80004002 [0217.433] CoGetContextToken (in: pToken=0x559e070 | out: pToken=0x559e070) returned 0x0 [0217.433] CoGetContextToken (in: pToken=0x559e478 | out: pToken=0x559e478) returned 0x0 [0217.433] WbemLocator:IUnknown:QueryInterface (in: This=0x6002fd8, riid=0x7463fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e508 | out: ppvObject=0x559e508*=0x0) returned 0x80004002 [0217.433] WbemLocator:IUnknown:Release (This=0x6002fd8) returned 0x2 [0217.434] WbemLocator:IUnknown:Release (This=0x6002fd8) returned 0x1 [0217.434] CoGetContextToken (in: pToken=0x559eae8 | out: pToken=0x559eae8) returned 0x0 [0217.434] CoGetContextToken (in: pToken=0x559ea48 | out: pToken=0x559ea48) returned 0x0 [0217.434] WbemLocator:IUnknown:QueryInterface (in: This=0x6002fd8, riid=0x559eb18*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x559eb14 | out: ppvObject=0x559eb14*=0x6002fd8) returned 0x0 [0217.434] WbemLocator:IUnknown:AddRef (This=0x6002fd8) returned 0x3 [0217.434] WbemLocator:IUnknown:Release (This=0x6002fd8) returned 0x2 [0217.434] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6002118, puCount=0x559ecb0 | out: puCount=0x559ecb0*=0x2) returned 0x0 [0217.434] WbemDefPath:IWbemPath:GetText (in: This=0x6002118, lFlags=8, puBuffLength=0x559ecac*=0x0, pszText=0x0 | out: puBuffLength=0x559ecac*=0xf, pszText=0x0) returned 0x0 [0217.434] WbemDefPath:IWbemPath:GetText (in: This=0x6002118, lFlags=8, puBuffLength=0x559ecac*=0xf, pszText="00000000000000" | out: puBuffLength=0x559ecac*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0217.434] CoCreateInstance (in: rclsid=0x6ed41284*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6ed412e4*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x559eb88 | out: ppv=0x559eb88*=0x5ff2a20) returned 0x0 [0217.434] WbemLocator:IWbemLocator:ConnectServer (in: This=0x5ff2a20, strNetworkResource="\\\\.\\root\\CIMV2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x559ec1c | out: ppNamespace=0x559ec1c*=0x60021cc) returned 0x0 [0217.441] WbemLocator:IUnknown:QueryInterface (in: This=0x60021cc, riid=0x6ed41104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559eab8 | out: ppvObject=0x559eab8*=0x9fadec) returned 0x0 [0217.441] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x9fadec, pProxy=0x60021cc, pAuthnSvc=0x559eb08, pAuthzSvc=0x559eb04, pServerPrincName=0x559eafc, pAuthnLevel=0x559eb00, pImpLevel=0x559eaf0, pAuthInfo=0x559eaf4, pCapabilites=0x559eaf8 | out: pAuthnSvc=0x559eb08*=0xa, pAuthzSvc=0x559eb04*=0x0, pServerPrincName=0x559eafc, pAuthnLevel=0x559eb00*=0x6, pImpLevel=0x559eaf0*=0x2, pAuthInfo=0x559eaf4, pCapabilites=0x559eaf8*=0x1) returned 0x0 [0217.441] WbemLocator:IUnknown:Release (This=0x9fadec) returned 0x1 [0217.441] WbemLocator:IUnknown:QueryInterface (in: This=0x60021cc, riid=0x6ed410f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559eaac | out: ppvObject=0x559eaac*=0x9fae0c) returned 0x0 [0217.441] WbemLocator:IUnknown:QueryInterface (in: This=0x60021cc, riid=0x6ed41104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559eaa8 | out: ppvObject=0x559eaa8*=0x9fadec) returned 0x0 [0217.441] WbemLocator:IClientSecurity:SetBlanket (This=0x9fadec, pProxy=0x60021cc, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0217.441] WbemLocator:IUnknown:Release (This=0x9fadec) returned 0x2 [0217.441] WbemLocator:IUnknown:Release (This=0x9fae0c) returned 0x1 [0217.441] CoTaskMemFree (pv=0xa227f0) [0217.441] WbemLocator:IUnknown:Release (This=0x5ff2a20) returned 0x0 [0217.441] WbemLocator:IUnknown:QueryInterface (in: This=0x60021cc, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e6a8 | out: ppvObject=0x559e6a8*=0x9fae0c) returned 0x0 [0217.441] WbemLocator:IUnknown:QueryInterface (in: This=0x9fae0c, riid=0x7463fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x559e664 | out: ppvObject=0x559e664*=0x0) returned 0x80004002 [0217.442] WbemLocator:IUnknown:QueryInterface (in: This=0x9fae0c, riid=0x7463fe90*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x559e484 | out: ppvObject=0x559e484*=0x0) returned 0x80004002 [0217.442] WbemLocator:IUnknown:AddRef (This=0x9fae0c) returned 0x3 [0217.442] WbemLocator:IUnknown:QueryInterface (in: This=0x9fae0c, riid=0x7463f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x559dfc4 | out: ppvObject=0x559dfc4*=0x0) returned 0x80004002 [0217.442] WbemLocator:IUnknown:QueryInterface (in: This=0x9fae0c, riid=0x7463f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x559df74 | out: ppvObject=0x559df74*=0x0) returned 0x80004002 [0217.442] WbemLocator:IUnknown:QueryInterface (in: This=0x9fae0c, riid=0x7462c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559df80 | out: ppvObject=0x559df80*=0x9fad6c) returned 0x0 [0217.442] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x9fad6c, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x559df88 | out: pCid=0x559df88*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0217.442] WbemLocator:IUnknown:Release (This=0x9fad6c) returned 0x3 [0217.442] CoGetContextToken (in: pToken=0x559dfe0 | out: pToken=0x559dfe0) returned 0x0 [0217.442] CoGetContextToken (in: pToken=0x559e3e8 | out: pToken=0x559e3e8) returned 0x0 [0217.442] WbemLocator:IUnknown:QueryInterface (in: This=0x9fae0c, riid=0x7463fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e478 | out: ppvObject=0x559e478*=0x9fadf4) returned 0x0 [0217.442] WbemLocator:IRpcOptions:Query (in: This=0x9fadf4, pPrx=0x9fae0c, dwProperty=2, pdwValue=0x559e4a0 | out: pdwValue=0x559e4a0) returned 0x80004002 [0217.442] WbemLocator:IUnknown:Release (This=0x9fadf4) returned 0x3 [0217.443] WbemLocator:IUnknown:Release (This=0x9fae0c) returned 0x2 [0217.443] CoGetContextToken (in: pToken=0x559e9b8 | out: pToken=0x559e9b8) returned 0x0 [0217.443] CoGetContextToken (in: pToken=0x559e918 | out: pToken=0x559e918) returned 0x0 [0217.443] WbemLocator:IUnknown:QueryInterface (in: This=0x9fae0c, riid=0x559e9e8*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x559e9e4 | out: ppvObject=0x559e9e4*=0x60021cc) returned 0x0 [0217.443] WbemLocator:IUnknown:AddRef (This=0x60021cc) returned 0x4 [0217.443] WbemLocator:IUnknown:Release (This=0x60021cc) returned 0x3 [0217.443] WbemLocator:IUnknown:Release (This=0x60021cc) returned 0x2 [0217.443] SysStringLen (param_1=0x0) returned 0x0 [0217.443] CoGetContextToken (in: pToken=0x559e9b0 | out: pToken=0x559e9b0) returned 0x0 [0217.443] WbemLocator:IUnknown:AddRef (This=0x9fae0c) returned 0x3 [0217.443] WbemLocator:IUnknown:QueryInterface (in: This=0x9fae0c, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e844 | out: ppvObject=0x559e844*=0x9fae0c) returned 0x0 [0217.443] WbemLocator:IUnknown:Release (This=0x9fae0c) returned 0x3 [0217.443] WbemLocator:IUnknown:Release (This=0x9fae0c) returned 0x2 [0217.443] CoGetContextToken (in: pToken=0x559ea98 | out: pToken=0x559ea98) returned 0x0 [0217.443] WbemLocator:IUnknown:AddRef (This=0x60021cc) returned 0x3 [0217.443] IWbemServices:ExecQuery (in: This=0x60021cc, strQueryLanguage="WQL", strQuery="SELECT Manufacturer FROM Win32_BaseBoard", lFlags=16, pCtx=0x0, ppEnum=0x559ecb8 | out: ppEnum=0x559ecb8*=0x5ffebd4) returned 0x0 [0217.446] IUnknown:QueryInterface (in: This=0x5ffebd4, riid=0x6ed41104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559eb08 | out: ppvObject=0x559eb08*=0x5ffebd8) returned 0x0 [0217.446] IClientSecurity:QueryBlanket (in: This=0x5ffebd8, pProxy=0x5ffebd4, pAuthnSvc=0x559eb58, pAuthzSvc=0x559eb54, pServerPrincName=0x559eb4c, pAuthnLevel=0x559eb50, pImpLevel=0x559eb40, pAuthInfo=0x559eb44, pCapabilites=0x559eb48 | out: pAuthnSvc=0x559eb58*=0xa, pAuthzSvc=0x559eb54*=0x0, pServerPrincName=0x559eb4c, pAuthnLevel=0x559eb50*=0x6, pImpLevel=0x559eb40*=0x2, pAuthInfo=0x559eb44, pCapabilites=0x559eb48*=0x1) returned 0x0 [0217.446] IUnknown:Release (This=0x5ffebd8) returned 0x1 [0217.446] IUnknown:QueryInterface (in: This=0x5ffebd4, riid=0x6ed410f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559eafc | out: ppvObject=0x559eafc*=0x9fad1c) returned 0x0 [0217.446] IUnknown:QueryInterface (in: This=0x5ffebd4, riid=0x6ed41104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559eaf8 | out: ppvObject=0x559eaf8*=0x5ffebd8) returned 0x0 [0217.446] IClientSecurity:SetBlanket (This=0x5ffebd8, pProxy=0x5ffebd4, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0217.455] IUnknown:Release (This=0x5ffebd8) returned 0x2 [0217.455] WbemLocator:IUnknown:Release (This=0x9fad1c) returned 0x1 [0217.455] CoTaskMemFree (pv=0xa227c0) [0217.455] IUnknown:QueryInterface (in: This=0x5ffebd4, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e6f4 | out: ppvObject=0x559e6f4*=0x9fad1c) returned 0x0 [0217.455] WbemLocator:IUnknown:QueryInterface (in: This=0x9fad1c, riid=0x7463fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x559e6b0 | out: ppvObject=0x559e6b0*=0x0) returned 0x80004002 [0217.455] WbemLocator:IUnknown:QueryInterface (in: This=0x9fad1c, riid=0x7463fe90*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x559e4cc | out: ppvObject=0x559e4cc*=0x0) returned 0x80004002 [0217.455] WbemLocator:IUnknown:AddRef (This=0x9fad1c) returned 0x3 [0217.455] WbemLocator:IUnknown:QueryInterface (in: This=0x9fad1c, riid=0x7463f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x559e00c | out: ppvObject=0x559e00c*=0x0) returned 0x80004002 [0217.456] WbemLocator:IUnknown:QueryInterface (in: This=0x9fad1c, riid=0x7463f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x559dfbc | out: ppvObject=0x559dfbc*=0x0) returned 0x80004002 [0217.456] WbemLocator:IUnknown:QueryInterface (in: This=0x9fad1c, riid=0x7462c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559dfc8 | out: ppvObject=0x559dfc8*=0x9fac7c) returned 0x0 [0217.456] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x9fac7c, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x559dfd0 | out: pCid=0x559dfd0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0217.456] WbemLocator:IUnknown:Release (This=0x9fac7c) returned 0x3 [0217.456] CoGetContextToken (in: pToken=0x559e028 | out: pToken=0x559e028) returned 0x0 [0217.456] CoGetContextToken (in: pToken=0x559e430 | out: pToken=0x559e430) returned 0x0 [0217.456] WbemLocator:IUnknown:QueryInterface (in: This=0x9fad1c, riid=0x7463fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e4c0 | out: ppvObject=0x559e4c0*=0x9fad04) returned 0x0 [0217.456] WbemLocator:IRpcOptions:Query (in: This=0x9fad04, pPrx=0x9fad1c, dwProperty=2, pdwValue=0x559e4e8 | out: pdwValue=0x559e4e8) returned 0x80004002 [0217.456] WbemLocator:IUnknown:Release (This=0x9fad04) returned 0x3 [0217.456] WbemLocator:IUnknown:Release (This=0x9fad1c) returned 0x2 [0217.456] CoGetContextToken (in: pToken=0x559ea08 | out: pToken=0x559ea08) returned 0x0 [0217.456] CoGetContextToken (in: pToken=0x559e968 | out: pToken=0x559e968) returned 0x0 [0217.456] WbemLocator:IUnknown:QueryInterface (in: This=0x9fad1c, riid=0x559ea38*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x559ea34 | out: ppvObject=0x559ea34*=0x5ffebd4) returned 0x0 [0217.456] IUnknown:AddRef (This=0x5ffebd4) returned 0x4 [0217.456] IUnknown:Release (This=0x5ffebd4) returned 0x3 [0217.456] IUnknown:Release (This=0x5ffebd4) returned 0x2 [0217.456] WbemLocator:IUnknown:Release (This=0x60021cc) returned 0x2 [0217.456] SysStringLen (param_1=0x0) returned 0x0 [0217.456] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6002118, puCount=0x559ed04 | out: puCount=0x559ed04*=0x2) returned 0x0 [0217.456] WbemDefPath:IWbemPath:GetText (in: This=0x6002118, lFlags=4, puBuffLength=0x559ed00*=0x0, pszText=0x0 | out: puBuffLength=0x559ed00*=0xf, pszText=0x0) returned 0x0 [0217.456] WbemDefPath:IWbemPath:GetText (in: This=0x6002118, lFlags=4, puBuffLength=0x559ed00*=0xf, pszText="00000000000000" | out: puBuffLength=0x559ed00*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0217.456] CoGetContextToken (in: pToken=0x559eb50 | out: pToken=0x559eb50) returned 0x0 [0217.456] IUnknown:AddRef (This=0x5ffebd4) returned 0x3 [0217.457] IEnumWbemClassObject:Clone (in: This=0x5ffebd4, ppEnum=0x559ed10 | out: ppEnum=0x559ed10*=0x5ffec9c) returned 0x0 [0217.457] IUnknown:QueryInterface (in: This=0x5ffec9c, riid=0x6ed41104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559ebd4 | out: ppvObject=0x559ebd4*=0x5ffeca0) returned 0x0 [0217.457] IClientSecurity:QueryBlanket (in: This=0x5ffeca0, pProxy=0x5ffec9c, pAuthnSvc=0x559ec24, pAuthzSvc=0x559ec20, pServerPrincName=0x559ec18, pAuthnLevel=0x559ec1c, pImpLevel=0x559ec0c, pAuthInfo=0x559ec10, pCapabilites=0x559ec14 | out: pAuthnSvc=0x559ec24*=0xa, pAuthzSvc=0x559ec20*=0x0, pServerPrincName=0x559ec18, pAuthnLevel=0x559ec1c*=0x6, pImpLevel=0x559ec0c*=0x2, pAuthInfo=0x559ec10, pCapabilites=0x559ec14*=0x1) returned 0x0 [0217.457] IUnknown:Release (This=0x5ffeca0) returned 0x1 [0217.457] IUnknown:QueryInterface (in: This=0x5ffec9c, riid=0x6ed410f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559ebc8 | out: ppvObject=0x559ebc8*=0x9fafec) returned 0x0 [0217.457] IUnknown:QueryInterface (in: This=0x5ffec9c, riid=0x6ed41104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559ebc4 | out: ppvObject=0x559ebc4*=0x5ffeca0) returned 0x0 [0217.457] IClientSecurity:SetBlanket (This=0x5ffeca0, pProxy=0x5ffec9c, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0217.459] IUnknown:Release (This=0x5ffeca0) returned 0x2 [0217.459] WbemLocator:IUnknown:Release (This=0x9fafec) returned 0x1 [0217.459] CoTaskMemFree (pv=0xa227f0) [0217.459] IUnknown:QueryInterface (in: This=0x5ffec9c, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e7b0 | out: ppvObject=0x559e7b0*=0x9fafec) returned 0x0 [0217.459] WbemLocator:IUnknown:QueryInterface (in: This=0x9fafec, riid=0x7463fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x559e76c | out: ppvObject=0x559e76c*=0x0) returned 0x80004002 [0217.472] WbemLocator:IUnknown:QueryInterface (in: This=0x9fafec, riid=0x7463fe90*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x559e58c | out: ppvObject=0x559e58c*=0x0) returned 0x80004002 [0217.475] WbemLocator:IUnknown:AddRef (This=0x9fafec) returned 0x3 [0217.475] WbemLocator:IUnknown:QueryInterface (in: This=0x9fafec, riid=0x7463f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x559e0cc | out: ppvObject=0x559e0cc*=0x0) returned 0x80004002 [0217.475] WbemLocator:IUnknown:QueryInterface (in: This=0x9fafec, riid=0x7463f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x559e07c | out: ppvObject=0x559e07c*=0x0) returned 0x80004002 [0217.476] WbemLocator:IUnknown:QueryInterface (in: This=0x9fafec, riid=0x7462c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e088 | out: ppvObject=0x559e088*=0x9faf4c) returned 0x0 [0217.476] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x9faf4c, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x559e090 | out: pCid=0x559e090*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0217.476] WbemLocator:IUnknown:Release (This=0x9faf4c) returned 0x3 [0217.476] CoGetContextToken (in: pToken=0x559e0e8 | out: pToken=0x559e0e8) returned 0x0 [0217.476] CoGetContextToken (in: pToken=0x559e4f0 | out: pToken=0x559e4f0) returned 0x0 [0217.476] WbemLocator:IUnknown:QueryInterface (in: This=0x9fafec, riid=0x7463fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e580 | out: ppvObject=0x559e580*=0x9fafd4) returned 0x0 [0217.476] WbemLocator:IRpcOptions:Query (in: This=0x9fafd4, pPrx=0x9fafec, dwProperty=2, pdwValue=0x559e5a8 | out: pdwValue=0x559e5a8) returned 0x80004002 [0217.476] WbemLocator:IUnknown:Release (This=0x9fafd4) returned 0x3 [0217.476] WbemLocator:IUnknown:Release (This=0x9fafec) returned 0x2 [0217.476] CoGetContextToken (in: pToken=0x559eac0 | out: pToken=0x559eac0) returned 0x0 [0217.476] CoGetContextToken (in: pToken=0x559ea20 | out: pToken=0x559ea20) returned 0x0 [0217.476] WbemLocator:IUnknown:QueryInterface (in: This=0x9fafec, riid=0x559eaf0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x559eaec | out: ppvObject=0x559eaec*=0x5ffec9c) returned 0x0 [0217.476] IUnknown:AddRef (This=0x5ffec9c) returned 0x4 [0217.476] IUnknown:Release (This=0x5ffec9c) returned 0x3 [0217.476] IUnknown:Release (This=0x5ffec9c) returned 0x2 [0217.476] IUnknown:Release (This=0x5ffebd4) returned 0x2 [0217.476] SysStringLen (param_1=0x0) returned 0x0 [0217.476] IEnumWbemClassObject:Reset (This=0x5ffec9c) returned 0x0 [0217.477] CoTaskMemAlloc (cb=0x4) returned 0xa36120 [0217.477] IEnumWbemClassObject:Next (in: This=0x5ffec9c, lTimeout=-1, uCount=0x1, apObjects=0xa36120, puReturned=0x24c6e74 | out: apObjects=0xa36120*=0x5fff0d8, puReturned=0x24c6e74*=0x1) returned 0x0 [0217.481] IUnknown:QueryInterface (in: This=0x5fff0d8, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e370 | out: ppvObject=0x559e370*=0x5fff0d8) returned 0x0 [0217.481] IUnknown:QueryInterface (in: This=0x5fff0d8, riid=0x7463fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x559e32c | out: ppvObject=0x559e32c*=0x0) returned 0x80004002 [0217.481] IUnknown:QueryInterface (in: This=0x5fff0d8, riid=0x7463fe90*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x559e14c | out: ppvObject=0x559e14c*=0x0) returned 0x80004002 [0217.481] IUnknown:AddRef (This=0x5fff0d8) returned 0x3 [0217.481] IUnknown:QueryInterface (in: This=0x5fff0d8, riid=0x7463f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x559dc8c | out: ppvObject=0x559dc8c*=0x0) returned 0x80004002 [0217.481] IUnknown:QueryInterface (in: This=0x5fff0d8, riid=0x7463f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x559dc3c | out: ppvObject=0x559dc3c*=0x0) returned 0x80004002 [0217.481] IUnknown:QueryInterface (in: This=0x5fff0d8, riid=0x7462c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559dc48 | out: ppvObject=0x559dc48*=0x5fff0dc) returned 0x0 [0217.481] IMarshal:GetUnmarshalClass (in: This=0x5fff0dc, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x559dc50 | out: pCid=0x559dc50*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0217.481] IUnknown:Release (This=0x5fff0dc) returned 0x3 [0217.481] CoGetContextToken (in: pToken=0x559dca8 | out: pToken=0x559dca8) returned 0x0 [0217.482] CoGetContextToken (in: pToken=0x559e0b0 | out: pToken=0x559e0b0) returned 0x0 [0217.482] IUnknown:QueryInterface (in: This=0x5fff0d8, riid=0x7463fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e140 | out: ppvObject=0x559e140*=0x0) returned 0x80004002 [0217.482] IUnknown:Release (This=0x5fff0d8) returned 0x2 [0217.482] CoGetContextToken (in: pToken=0x559e680 | out: pToken=0x559e680) returned 0x0 [0217.482] CoGetContextToken (in: pToken=0x559e5e0 | out: pToken=0x559e5e0) returned 0x0 [0217.482] IUnknown:QueryInterface (in: This=0x5fff0d8, riid=0x559e6b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x559e6ac | out: ppvObject=0x559e6ac*=0x5fff0d8) returned 0x0 [0217.482] IUnknown:AddRef (This=0x5fff0d8) returned 0x4 [0217.482] IUnknown:Release (This=0x5fff0d8) returned 0x3 [0217.482] IUnknown:Release (This=0x5fff0d8) returned 0x2 [0217.482] CoTaskMemFree (pv=0xa36120) [0217.482] CoGetContextToken (in: pToken=0x559e9f0 | out: pToken=0x559e9f0) returned 0x0 [0217.482] IUnknown:AddRef (This=0x5fff0d8) returned 0x3 [0217.482] IWbemClassObject:Get (in: This=0x5fff0d8, wszName="__GENUS", lFlags=0, pVal=0x559ed00*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x559ed80*=0, plFlavor=0x559ed7c*=0 | out: pVal=0x559ed00*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x559ed80*=3, plFlavor=0x559ed7c*=64) returned 0x0 [0217.482] IWbemClassObject:Get (in: This=0x5fff0d8, wszName="__PATH", lFlags=0, pVal=0x559ece4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x559ed68*=0, plFlavor=0x559ed64*=0 | out: pVal=0x559ece4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x559ed68*=8, plFlavor=0x559ed64*=64) returned 0x0 [0217.486] IWbemClassObject:Get (in: This=0x5fff0d8, wszName="__RELPATH", lFlags=0, pVal=0x559ece4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x559ed68*=8, plFlavor=0x559ed64*=64 | out: pVal=0x559ece4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x559ed68*=8, plFlavor=0x559ed64*=64) returned 0x0 [0217.487] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6002118, puCount=0x559ed3c | out: puCount=0x559ed3c*=0x2) returned 0x0 [0217.487] WbemDefPath:IWbemPath:GetText (in: This=0x6002118, lFlags=4, puBuffLength=0x559ed38*=0x0, pszText=0x0 | out: puBuffLength=0x559ed38*=0xf, pszText=0x0) returned 0x0 [0217.487] WbemDefPath:IWbemPath:GetText (in: This=0x6002118, lFlags=4, puBuffLength=0x559ed38*=0xf, pszText="00000000000000" | out: puBuffLength=0x559ed38*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0217.487] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6002118, puCount=0x559ed0c | out: puCount=0x559ed0c*=0x2) returned 0x0 [0217.487] WbemDefPath:IWbemPath:GetText (in: This=0x6002118, lFlags=4, puBuffLength=0x559ed08*=0x0, pszText=0x0 | out: puBuffLength=0x559ed08*=0xf, pszText=0x0) returned 0x0 [0217.487] WbemDefPath:IWbemPath:GetText (in: This=0x6002118, lFlags=4, puBuffLength=0x559ed08*=0xf, pszText="00000000000000" | out: puBuffLength=0x559ed08*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0217.487] IWbemClassObject:Get (in: This=0x5fff0d8, wszName="Manufacturer", lFlags=0, pVal=0x559ed08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24c72a4*=0, plFlavor=0x24c72a8*=0 | out: pVal=0x559ed08*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"Intel Corp.\"", varVal2=0x0), pType=0x24c72a4*=8, plFlavor=0x24c72a8*=0) returned 0x0 [0217.487] SysStringByteLen (bstr="\"Intel Corp.\"") returned 0x1a [0217.487] SysStringByteLen (bstr="\"Intel Corp.\"") returned 0x1a [0217.487] IWbemClassObject:Get (in: This=0x5fff0d8, wszName="Manufacturer", lFlags=0, pVal=0x559ed10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24c72a4*=8, plFlavor=0x24c72a8*=0 | out: pVal=0x559ed10*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"Intel Corp.\"", varVal2=0x0), pType=0x24c72a4*=8, plFlavor=0x24c72a8*=0) returned 0x0 [0217.487] SysStringByteLen (bstr="\"Intel Corp.\"") returned 0x1a [0217.487] SysStringByteLen (bstr="\"Intel Corp.\"") returned 0x1a [0217.487] CoTaskMemAlloc (cb=0x4) returned 0xa36120 [0217.488] IEnumWbemClassObject:Next (in: This=0x5ffec9c, lTimeout=-1, uCount=0x1, apObjects=0xa36120, puReturned=0x24c6e74 | out: apObjects=0xa36120*=0x0, puReturned=0x24c6e74*=0x0) returned 0x1 [0217.488] CoTaskMemFree (pv=0xa36120) [0217.488] CoGetContextToken (in: pToken=0x559ec38 | out: pToken=0x559ec38) returned 0x0 [0217.488] WbemLocator:IUnknown:Release (This=0x9fafec) returned 0x1 [0217.488] IUnknown:Release (This=0x5ffec9c) returned 0x0 [0217.489] GetSystemMetrics (nIndex=80) returned 1 [0217.644] EnumDisplayMonitors (hdc=0x0, lprcClip=0x0, lpfnEnum=0x4610866, dwData=0x0) returned 1 [0217.662] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x559eb38 | out: lpmi=0x559eb38) returned 1 [0217.662] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x70101fc [0217.678] GetDeviceCaps (hdc=0x70101fc, index=12) returned 32 [0217.678] GetDeviceCaps (hdc=0x70101fc, index=14) returned 1 [0217.678] DeleteDC (hdc=0x70101fc) returned 1 [0217.683] GetUserObjectInformationA (in: hObj=0x5c, nIndex=1, pvInfo=0x24c7c0c, nLength=0xc, lpnLengthNeeded=0x559ed0c | out: pvInfo=0x24c7c0c, lpnLengthNeeded=0x559ed0c) returned 1 [0217.683] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x30c [0217.697] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x559e764, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0217.698] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Hardware & Soft.txt", nBufferLength=0x105, lpBuffer=0x559e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Hardware & Soft.txt", lpFilePart=0x0) returned 0x86 [0217.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec6c) returned 1 [0217.698] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Hardware & Soft.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\hardware & soft.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x32c [0217.699] GetFileType (hFile=0x32c) returned 0x1 [0217.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x559ec68) returned 1 [0217.699] GetFileType (hFile=0x32c) returned 0x1 [0217.699] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x559ec40*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x559ec40*=0) returned 0x0 [0217.699] WriteFile (in: hFile=0x32c, lpBuffer=0x24c9c50*, nNumberOfBytesToWrite=0x111, lpNumberOfBytesWritten=0x559ed14, lpOverlapped=0x0 | out: lpBuffer=0x24c9c50*, lpNumberOfBytesWritten=0x559ed14*=0x111, lpOverlapped=0x0) returned 1 [0217.700] CloseHandle (hObject=0x32c) returned 1 [0217.705] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34298d0, Length=0x20000, ResultLength=0x559ed74 | out: SystemInformation=0x34298d0, ResultLength=0x559ed74*=0x7f60) returned 0x0 [0217.711] GetCurrentProcess () returned 0xffffffff [0217.711] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x559ed58 | out: TokenHandle=0x559ed58*=0x32c) returned 1 [0217.711] GetTokenInformation (in: TokenHandle=0x32c, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x559ed58 | out: TokenInformation=0x0, ReturnLength=0x559ed58) returned 0 [0217.711] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0xa360f0 [0217.711] GetTokenInformation (in: TokenHandle=0x32c, TokenInformationClass=0x8, TokenInformation=0xa360f0, TokenInformationLength=0x4, ReturnLength=0x559ed58 | out: TokenInformation=0xa360f0, ReturnLength=0x559ed58) returned 1 [0217.711] LocalFree (hMem=0xa360f0) returned 0x0 [0217.711] DuplicateTokenEx (in: hExistingToken=0x32c, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x559ed60 | out: phNewToken=0x559ed60*=0x47c) returned 1 [0217.712] CheckTokenMembership (in: TokenHandle=0x47c, SidToCheck=0x24ebf18*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x559ed70 | out: IsMember=0x559ed70) returned 1 [0217.712] CloseHandle (hObject=0x47c) returned 1 [0217.987] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe.Config", nBufferLength=0x105, lpBuffer=0x559e6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe.Config", lpFilePart=0x0) returned 0x40 [0217.987] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe.Config", nBufferLength=0x105, lpBuffer=0x559e66c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe.Config", lpFilePart=0x0) returned 0x40 [0217.994] GetCurrentProcess () returned 0xffffffff [0217.994] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x559ea14 | out: TokenHandle=0x559ea14*=0x47c) returned 1 [0217.997] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x559e4f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0217.998] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x559ea14 | out: lpFileInformation=0x559ea14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0cc4300, ftCreationTime.dwHighDateTime=0x1cd5cf4, ftLastAccessTime.dwLowDateTime=0xcf7ee640, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc0cc4300, ftLastWriteTime.dwHighDateTime=0x1cd5cf4, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0217.999] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x559e4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0217.999] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x559ea14 | out: lpFileInformation=0x559ea14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0cc4300, ftCreationTime.dwHighDateTime=0x1cd5cf4, ftLastAccessTime.dwLowDateTime=0xcf7ee640, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc0cc4300, ftLastWriteTime.dwHighDateTime=0x1cd5cf4, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0218.000] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x559e44c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0218.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559e940) returned 1 [0218.000] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x330 [0218.000] GetFileType (hFile=0x330) returned 0x1 [0218.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x559e93c) returned 1 [0218.000] GetFileType (hFile=0x330) returned 0x1 [0218.016] GetFileSize (in: hFile=0x330, lpFileSizeHigh=0x559ea08 | out: lpFileSizeHigh=0x559ea08*=0x0) returned 0x8c8f [0218.016] ReadFile (in: hFile=0x330, lpBuffer=0x24eee8c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x559e9c4, lpOverlapped=0x0 | out: lpBuffer=0x24eee8c*, lpNumberOfBytesRead=0x559e9c4*=0x1000, lpOverlapped=0x0) returned 1 [0218.032] ReadFile (in: hFile=0x330, lpBuffer=0x24eee8c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x559e860, lpOverlapped=0x0 | out: lpBuffer=0x24eee8c*, lpNumberOfBytesRead=0x559e860*=0x1000, lpOverlapped=0x0) returned 1 [0218.038] ReadFile (in: hFile=0x330, lpBuffer=0x24eee8c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x559e714, lpOverlapped=0x0 | out: lpBuffer=0x24eee8c*, lpNumberOfBytesRead=0x559e714*=0x1000, lpOverlapped=0x0) returned 1 [0218.038] ReadFile (in: hFile=0x330, lpBuffer=0x24eee8c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x559e714, lpOverlapped=0x0 | out: lpBuffer=0x24eee8c*, lpNumberOfBytesRead=0x559e714*=0x1000, lpOverlapped=0x0) returned 1 [0218.038] ReadFile (in: hFile=0x330, lpBuffer=0x24eee8c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x559e714, lpOverlapped=0x0 | out: lpBuffer=0x24eee8c*, lpNumberOfBytesRead=0x559e714*=0x1000, lpOverlapped=0x0) returned 1 [0218.038] ReadFile (in: hFile=0x330, lpBuffer=0x24eee8c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x559e64c, lpOverlapped=0x0 | out: lpBuffer=0x24eee8c*, lpNumberOfBytesRead=0x559e64c*=0x1000, lpOverlapped=0x0) returned 1 [0218.041] ReadFile (in: hFile=0x330, lpBuffer=0x24eee8c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x559e7c8, lpOverlapped=0x0 | out: lpBuffer=0x24eee8c*, lpNumberOfBytesRead=0x559e7c8*=0x1000, lpOverlapped=0x0) returned 1 [0218.041] ReadFile (in: hFile=0x330, lpBuffer=0x24eee8c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x559e6dc, lpOverlapped=0x0 | out: lpBuffer=0x24eee8c*, lpNumberOfBytesRead=0x559e6dc*=0x1000, lpOverlapped=0x0) returned 1 [0218.042] ReadFile (in: hFile=0x330, lpBuffer=0x24eee8c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x559e6dc, lpOverlapped=0x0 | out: lpBuffer=0x24eee8c*, lpNumberOfBytesRead=0x559e6dc*=0xc8f, lpOverlapped=0x0) returned 1 [0218.042] ReadFile (in: hFile=0x330, lpBuffer=0x24eee8c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x559e79c, lpOverlapped=0x0 | out: lpBuffer=0x24eee8c*, lpNumberOfBytesRead=0x559e79c*=0x0, lpOverlapped=0x0) returned 1 [0218.042] CloseHandle (hObject=0x330) returned 1 [0218.042] GetCurrentProcess () returned 0xffffffff [0218.042] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x559eb48 | out: TokenHandle=0x559eb48*=0x330) returned 1 [0218.043] GetCurrentProcess () returned 0xffffffff [0218.043] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x559eb48 | out: TokenHandle=0x559eb48*=0x334) returned 1 [0218.043] GetCurrentProcess () returned 0xffffffff [0218.043] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x559ea14 | out: TokenHandle=0x559ea14*=0x338) returned 1 [0218.044] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe.Config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\msbuild.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x559ea14 | out: lpFileInformation=0x559ea14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20195d00, ftCreationTime.dwHighDateTime=0x1cac5eb, ftLastAccessTime.dwLowDateTime=0x9ef93520, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x20195d00, ftLastWriteTime.dwHighDateTime=0x1cac5eb, nFileSizeHigh=0x0, nFileSizeLow=0x6c6)) returned 1 [0218.044] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe.Config", nBufferLength=0x105, lpBuffer=0x559e4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe.Config", lpFilePart=0x0) returned 0x40 [0218.044] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe.Config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\msbuild.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x559ea14 | out: lpFileInformation=0x559ea14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20195d00, ftCreationTime.dwHighDateTime=0x1cac5eb, ftLastAccessTime.dwLowDateTime=0x9ef93520, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x20195d00, ftLastWriteTime.dwHighDateTime=0x1cac5eb, nFileSizeHigh=0x0, nFileSizeLow=0x6c6)) returned 1 [0218.044] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe.Config", nBufferLength=0x105, lpBuffer=0x559e44c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe.Config", lpFilePart=0x0) returned 0x40 [0218.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559e940) returned 1 [0218.044] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe.Config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\msbuild.exe.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0218.044] GetFileType (hFile=0x33c) returned 0x1 [0218.044] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x559e93c) returned 1 [0218.044] GetFileType (hFile=0x33c) returned 0x1 [0218.044] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x559ea08 | out: lpFileSizeHigh=0x559ea08*=0x0) returned 0x6c6 [0218.044] ReadFile (in: hFile=0x33c, lpBuffer=0x2508404, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x559e9c4, lpOverlapped=0x0 | out: lpBuffer=0x2508404*, lpNumberOfBytesRead=0x559e9c4*=0x6c6, lpOverlapped=0x0) returned 1 [0218.046] ReadFile (in: hFile=0x33c, lpBuffer=0x2508404, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x559e888, lpOverlapped=0x0 | out: lpBuffer=0x2508404*, lpNumberOfBytesRead=0x559e888*=0x0, lpOverlapped=0x0) returned 1 [0218.046] CloseHandle (hObject=0x33c) returned 1 [0218.046] GetCurrentProcess () returned 0xffffffff [0218.046] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x559eb48 | out: TokenHandle=0x559eb48*=0x33c) returned 1 [0218.046] GetCurrentProcess () returned 0xffffffff [0218.046] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x559eb48 | out: TokenHandle=0x559eb48*=0x340) returned 1 [0218.057] GetCurrentProcess () returned 0xffffffff [0218.057] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x559e910 | out: TokenHandle=0x559e910*=0x344) returned 1 [0218.080] GetCurrentProcess () returned 0xffffffff [0218.080] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x559e920 | out: TokenHandle=0x559e920*=0x348) returned 1 [0218.106] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x34c [0218.106] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x350 [0218.109] GetCurrentProcess () returned 0xffffffff [0218.109] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x559e8ec | out: TokenHandle=0x559e8ec*=0x354) returned 1 [0218.111] GetCurrentProcess () returned 0xffffffff [0218.111] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x559e8fc | out: TokenHandle=0x559e8fc*=0x358) returned 1 [0218.113] QueryPerformanceFrequency (in: lpFrequency=0x177ee8 | out: lpFrequency=0x177ee8*=100000000) returned 1 [0218.113] QueryPerformanceCounter (in: lpPerformanceCount=0x559ed00 | out: lpPerformanceCount=0x559ed00*=12737382862) returned 1 [0218.117] GetCurrentProcess () returned 0xffffffff [0218.117] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x559e8b8 | out: TokenHandle=0x559e8b8*=0x328) returned 1 [0218.118] GetCurrentProcess () returned 0xffffffff [0218.118] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x559e8c8 | out: TokenHandle=0x559e8c8*=0x48c) returned 1 [0218.129] GetCurrentProcess () returned 0xffffffff [0218.129] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x559e8cc | out: TokenHandle=0x559e8cc*=0x4d4) returned 1 [0218.137] GetCurrentProcess () returned 0xffffffff [0218.137] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x559e8dc | out: TokenHandle=0x559e8dc*=0x4f0) returned 1 [0218.142] GetCurrentProcess () returned 0xffffffff [0218.142] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x559ebe8 | out: TokenHandle=0x559ebe8*=0x4f4) returned 1 [0218.148] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x559dd34 | out: phkResult=0x559dd34*=0x4f8) returned 0x0 [0218.148] RegQueryValueExW (in: hKey=0x4f8, lpValueName="InstallationType", lpReserved=0x0, lpType=0x559dd54, lpData=0x0, lpcbData=0x559dd50*=0x0 | out: lpType=0x559dd54*=0x1, lpData=0x0, lpcbData=0x559dd50*=0xe) returned 0x0 [0218.149] RegQueryValueExW (in: hKey=0x4f8, lpValueName="InstallationType", lpReserved=0x0, lpType=0x559dd54, lpData=0x25140c4, lpcbData=0x559dd50*=0xe | out: lpType=0x559dd54*=0x1, lpData="Client", lpcbData=0x559dd50*=0xe) returned 0x0 [0218.149] RegCloseKey (hKey=0x4f8) returned 0x0 [0218.160] CoTaskMemAlloc (cb=0xcc0) returned 0x60976c0 [0218.160] RasEnumConnectionsW (in: param_1=0x60976c0, param_2=0x559ebf8, param_3=0x559ebfc | out: param_1=0x60976c0, param_2=0x559ebf8, param_3=0x559ebfc) returned 0x0 [0218.321] CoTaskMemFree (pv=0x60976c0) [0218.326] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x559e9e0 | out: lpWSAData=0x559e9e0) returned 0 [0218.333] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x538 [0218.363] setsockopt (s=0x538, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0218.363] closesocket (s=0x538) returned 0 [0218.363] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x538 [0218.388] setsockopt (s=0x538, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0218.388] closesocket (s=0x538) returned 0 [0218.388] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x538 [0218.389] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x41c [0218.389] ioctlsocket (in: s=0x538, cmd=-2147195266, argp=0x559ec00 | out: argp=0x559ec00) returned 0 [0218.389] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x53c [0218.390] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x540 [0218.390] ioctlsocket (in: s=0x53c, cmd=-2147195266, argp=0x559ec00 | out: argp=0x559ec00) returned 0 [0218.390] WSAIoctl (in: s=0x538, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x559ebe8, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x559ebe8, lpOverlapped=0x0) returned -1 [0218.391] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x559e918, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0218.393] WSAEventSelect (s=0x538, hEventObject=0x41c, lNetworkEvents=512) returned 0 [0218.393] WSAIoctl (in: s=0x53c, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x559ebe8, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x559ebe8, lpOverlapped=0x0) returned -1 [0218.393] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x559e918, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0218.393] WSAEventSelect (s=0x53c, hEventObject=0x540, lNetworkEvents=512) returned 0 [0218.393] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x548 [0218.394] RasConnectionNotificationW (param_1=0xffffffff, param_2=0x548, param_3=0x3) returned 0x0 [0218.399] RegOpenCurrentUser (in: samDesired=0x20019, phkResult=0x559ec14 | out: phkResult=0x559ec14*=0x560) returned 0x0 [0218.399] RegOpenKeyExW (in: hKey=0x560, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ebc4 | out: phkResult=0x559ebc4*=0x564) returned 0x0 [0218.400] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x568 [0218.400] RegNotifyChangeKeyValue (hKey=0x564, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x568, fAsynchronous=1) returned 0x0 [0218.401] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ebc8 | out: phkResult=0x559ebc8*=0x56c) returned 0x0 [0218.401] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x570 [0218.401] RegNotifyChangeKeyValue (hKey=0x56c, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x570, fAsynchronous=1) returned 0x0 [0218.401] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ebc8 | out: phkResult=0x559ebc8*=0x574) returned 0x0 [0218.401] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x578 [0218.401] RegNotifyChangeKeyValue (hKey=0x574, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x578, fAsynchronous=1) returned 0x0 [0218.401] GetCurrentProcess () returned 0xffffffff [0218.401] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x559ebbc | out: TokenHandle=0x559ebbc*=0x57c) returned 1 [0218.402] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x559e4c8 | out: phkResult=0x559e4c8*=0x580) returned 0x0 [0218.403] RegQueryValueExW (in: hKey=0x580, lpValueName="LegacyWPADSupport", lpReserved=0x0, lpType=0x559e4e4, lpData=0x0, lpcbData=0x559e4e0*=0x0 | out: lpType=0x559e4e4*=0x0, lpData=0x0, lpcbData=0x559e4e0*=0x0) returned 0x2 [0218.403] RegCloseKey (hKey=0x580) returned 0x0 [0218.416] WinHttpOpen (pszAgentW=0x0, dwAccessType=0x1, pszProxyW=0x0, pszProxyBypassW=0x0, dwFlags=0x0) returned 0xa087b0 [0218.486] WinHttpSetTimeouts (hInternet=0xa087b0, nResolveTimeout=60000, nConnectTimeout=60000, nSendTimeout=60000, nReceiveTimeout=60000) returned 1 [0218.486] WinHttpGetIEProxyConfigForCurrentUser (in: pProxyConfig=0x559ebc8 | out: pProxyConfig=0x559ebc8) returned 1 [0218.532] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_Disabled", lpBuffer=0x559e440, nSize=0x80 | out: lpBuffer="ᄰ熢禴熢朩瑐禴熢烕瑐㵒ῴ禴熢က熢ു؀퐽瑐ു") returned 0x0 [0218.533] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_MinCount", lpBuffer=0x559e440, nSize=0x80 | out: lpBuffer="ᄰ熢禴熢朩瑐禴熢烕瑐㵒ῴ禴熢") returned 0x0 [0218.534] EtwEventRegister () returned 0x0 [0218.537] GetCurrentProcess () returned 0xffffffff [0218.537] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x559e894 | out: TokenHandle=0x559e894*=0x5b8) returned 1 [0218.539] GetCurrentProcess () returned 0xffffffff [0218.539] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x559e8a4 | out: TokenHandle=0x559e8a4*=0x5c0) returned 1 [0218.543] GetCurrentProcess () returned 0xffffffff [0218.543] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x559e83c | out: TokenHandle=0x559e83c*=0x5c4) returned 1 [0218.544] GetCurrentProcess () returned 0xffffffff [0218.544] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x559e84c | out: TokenHandle=0x559e84c*=0x5c8) returned 1 [0218.545] SetEvent (hEvent=0x34c) returned 1 [0218.552] SetEvent (hEvent=0x34c) returned 1 [0218.560] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x559eb74 | out: pFixedInfo=0x0, pOutBufLen=0x559eb74) returned 0x6f [0218.581] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x60b1df8 [0218.581] GetNetworkParams (in: pFixedInfo=0x60b1df8, pOutBufLen=0x559eb74 | out: pFixedInfo=0x60b1df8, pOutBufLen=0x559eb74) returned 0x0 [0218.592] LocalFree (hMem=0x60b1df8) returned 0x0 [0218.593] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_Disabled", lpBuffer=0x559e37c, nSize=0x80 | out: lpBuffer="ꑂ瑢") returned 0x0 [0218.593] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_MinCount", lpBuffer=0x559e37c, nSize=0x80 | out: lpBuffer="ꑂ瑢") returned 0x0 [0218.594] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x5f0 [0218.596] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x5ec [0218.596] GetAddrInfoW (in: pNodeName="ip-api.com", pServiceName=0x0, pHints=0x559ea64*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x559ea0c | out: ppResult=0x559ea0c*=0x60763a8*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ip-api.com", ai_addr=0x609d110*(sa_family=2, sin_port=0x0, sin_addr="208.95.112.1"), ai_next=0x0)) returned 0 [0218.671] FreeAddrInfoW (pAddrInfo=0x60763a8*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ip-api.com", ai_addr=0x609d110*(sa_family=2, sin_port=0x0, sin_addr="208.95.112.1"), ai_next=0x0)) [0218.672] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x5f8 [0218.672] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x600 [0218.672] ioctlsocket (in: s=0x5f8, cmd=-2147195266, argp=0x559ea3c | out: argp=0x559ea3c) returned 0 [0218.672] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x604 [0218.673] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x608 [0218.673] ioctlsocket (in: s=0x604, cmd=-2147195266, argp=0x559ea3c | out: argp=0x559ea3c) returned 0 [0218.673] WSAIoctl (in: s=0x5f8, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x559ea24, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x559ea24, lpOverlapped=0x0) returned -1 [0218.673] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x559e754, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0218.673] WSAEventSelect (s=0x5f8, hEventObject=0x600, lNetworkEvents=512) returned 0 [0218.673] WSAIoctl (in: s=0x604, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x559ea24, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x559ea24, lpOverlapped=0x0) returned -1 [0218.673] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x559e754, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0218.673] WSAEventSelect (s=0x604, hEventObject=0x608, lNetworkEvents=512) returned 0 [0218.674] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0x0, SizePointer=0x559ea20*=0x0 | out: AdapterAddresses=0x0, SizePointer=0x559ea20*=0x7e0) returned 0x6f [0218.680] LocalAlloc (uFlags=0x0, uBytes=0x7e0) returned 0x6073fe8 [0218.680] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0x6073fe8, SizePointer=0x559ea20*=0x7e0 | out: AdapterAddresses=0x6073fe8*(Alignment=0xe00000178, Length=0x178, IfIndex=0xe, Next=0x60742ac, AdapterName="{208C2C2F-ECA0-4B34-8C2D-83B1FBC25E0D}", FirstUnicastAddress=0x6074220, FirstAnycastAddress=0x0, FirstMulticastAddress=0x0, FirstDnsServerAddress=0x0, DnsSuffix="", Description="Intel(R) PRO/1000 MT Network Connection #2", FriendlyName="Local Area Connection 2", PhysicalAddress=([0]=0x0, [1]=0xa, [2]=0xa7, [3]=0xf, [4]=0xcf, [5]=0xcf, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x6, Flags=0x3e5, DdnsEnabled=0x3e5, RegisterAdapterSuffix=0x3e5, Dhcpv4Enabled=0x3e5, ReceiveOnly=0x3e5, NoMulticast=0x3e5, Ipv6OtherStatefulConfig=0x3e5, NetbiosOverTcpipEnabled=0x3e5, Ipv4Enabled=0x3e5, Ipv6Enabled=0x3e5, Ipv6ManagedAddressConfigurationSupported=0x3e5, Mtu=0x5dc, IfType=0x6, OperStatus=0x1, Ipv6IfIndex=0xe, ZoneIndices=([0]=0xe, [1]=0xe, [2]=0xe, [3]=0xe, [4]=0x1, [5]=0x1, [6]=0x1, [7]=0x1, [8]=0x1, [9]=0x1, [10]=0x1, [11]=0x1, [12]=0x1, [13]=0x1, [14]=0x0, [15]=0x1), FirstPrefix=0x0, TransmitLinkSpeed=0x3b9aca00, ReceiveLinkSpeed=0x3b9aca00, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x0, Ipv4Metric=0xa, Ipv6Metric=0xa, Luid=0x6000007000000, Dhcpv4Server.lpSockaddr=0x6074160*(sa_family=2, sin_port=0x0, sin_addr="192.168.0.1"), Dhcpv4Server.iSockaddrLength=16, CompartmentId=0x1, NetworkGuid=0x11de7039846ee341, ConnectionType=0x1, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x1, [2]=0x0, [3]=0x1, [4]=0x20, [5]=0xc7, [6]=0x5c, [7]=0xa7, [8]=0xc4, [9]=0x3d, [10]=0xc7, [11]=0x58, [12]=0x4a, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0xe, Dhcpv6Iaid=0x11c43dc7, FirstDnsSuffix=0x0), SizePointer=0x559ea20*=0x7e0) returned 0x0 [0218.689] LocalFree (hMem=0x6073fe8) returned 0x0 [0218.691] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x559ea34 | out: phkResult=0x559ea34*=0x5fc) returned 0x0 [0218.691] RegQueryValueExW (in: hKey=0x5fc, lpValueName="HWRPortReuseOnSocketBind", lpReserved=0x0, lpType=0x559ea50, lpData=0x0, lpcbData=0x559ea4c*=0x0 | out: lpType=0x559ea50*=0x0, lpData=0x0, lpcbData=0x559ea4c*=0x0) returned 0x2 [0218.691] RegCloseKey (hKey=0x5fc) returned 0x0 [0218.691] WSAConnect (in: s=0x5f0, name=0x2520c94*(sa_family=2, sin_port=0x50, sin_addr="208.95.112.1"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0 [0218.714] closesocket (s=0x5ec) returned 0 [0218.718] send (s=0x5f0, buf=0x25217c4*, len=64, flags=0) returned 64 [0218.719] setsockopt (s=0x5f0, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0218.720] recv (in: s=0x5f0, buf=0x251d194, len=4096, flags=0 | out: buf=0x251d194*) returned 633 [0218.762] setsockopt (s=0x5f0, level=65535, optname=4102, optval="à\x93\x04", optlen=4) returned 0 [0218.762] SetEvent (hEvent=0x34c) returned 1 [0218.781] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x559e764, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0218.781] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Hardware & Soft.txt", nBufferLength=0x105, lpBuffer=0x559e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Hardware & Soft.txt", lpFilePart=0x0) returned 0x86 [0218.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec6c) returned 1 [0218.781] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Hardware & Soft.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\hardware & soft.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5ec [0218.781] GetFileType (hFile=0x5ec) returned 0x1 [0218.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x559ec68) returned 1 [0218.781] GetFileType (hFile=0x5ec) returned 0x1 [0218.782] SetFilePointer (in: hFile=0x5ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x559ec40*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x559ec40*=0) returned 0x111 [0218.782] WriteFile (in: hFile=0x5ec, lpBuffer=0x252d2a8*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x559ed14, lpOverlapped=0x0 | out: lpBuffer=0x252d2a8*, lpNumberOfBytesWritten=0x559ed14*=0x85, lpOverlapped=0x0) returned 1 [0218.782] CloseHandle (hObject=0x5ec) returned 1 [0218.783] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x559e764, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0218.783] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Hardware & Soft.txt", nBufferLength=0x105, lpBuffer=0x559e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Hardware & Soft.txt", lpFilePart=0x0) returned 0x86 [0218.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec6c) returned 1 [0218.783] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Hardware & Soft.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\hardware & soft.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5ec [0218.784] GetFileType (hFile=0x5ec) returned 0x1 [0218.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x559ec68) returned 1 [0218.784] GetFileType (hFile=0x5ec) returned 0x1 [0218.784] SetFilePointer (in: hFile=0x5ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x559ec40*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x559ec40*=0) returned 0x196 [0218.784] WriteFile (in: hFile=0x5ec, lpBuffer=0x252fa10*, nNumberOfBytesToWrite=0x3, lpNumberOfBytesWritten=0x559ed14, lpOverlapped=0x0 | out: lpBuffer=0x252fa10*, lpNumberOfBytesWritten=0x559ed14*=0x3, lpOverlapped=0x0) returned 1 [0218.784] CloseHandle (hObject=0x5ec) returned 1 [0218.796] GetComputerNameW (in: lpBuffer=0x559eb58, nSize=0x559edd0 | out: lpBuffer="XDUWTFONO", nSize=0x559edd0) returned 1 [0218.797] CoGetObjectContext (in: riid=0x24bbd70*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x559ed5c | out: ppv=0x559ed5c*=0x98faac) returned 0x0 [0218.797] IComThreadingInfo:GetCurrentApartmentType (in: This=0x98faac, pAptType=0x559ed54 | out: pAptType=0x559ed54*=1) returned 0x0 [0218.797] IUnknown:QueryInterface (in: This=0x98faac, riid=0x24bbd58*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x559ed58 | out: ppvObject=0x559ed58*=0x0) returned 0x80004002 [0218.797] IUnknown:Release (This=0x98faac) returned 0x1 [0218.798] CoGetClassObject (in: rclsid=0xa2255c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7459d1fc*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x559e6c8 | out: ppv=0x559e6c8*=0x5ffecf0) returned 0x0 [0218.798] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ffecf0, riid=0x745d0ae0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x559e8e0 | out: ppvObject=0x559e8e0*=0x0) returned 0x80004002 [0218.798] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5ffecf0, pUnkOuter=0x0, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e8f4 | out: ppvObject=0x559e8f4*=0x5ffec10) returned 0x0 [0218.798] WbemDefPath:IUnknown:Release (This=0x5ffecf0) returned 0x0 [0218.798] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ffec10, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e514 | out: ppvObject=0x559e514*=0x5ffec10) returned 0x0 [0218.798] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ffec10, riid=0x7463fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x559e4d0 | out: ppvObject=0x559e4d0*=0x0) returned 0x80004002 [0218.798] WbemDefPath:IUnknown:AddRef (This=0x5ffec10) returned 0x3 [0218.798] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ffec10, riid=0x7463f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x559de2c | out: ppvObject=0x559de2c*=0x0) returned 0x80004002 [0218.798] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ffec10, riid=0x7463f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x559dddc | out: ppvObject=0x559dddc*=0x0) returned 0x80004002 [0218.798] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ffec10, riid=0x7462c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559dde8 | out: ppvObject=0x559dde8*=0x609b798) returned 0x0 [0218.798] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x609b798, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x559ddf0 | out: pCid=0x559ddf0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0218.798] WbemDefPath:IUnknown:Release (This=0x609b798) returned 0x3 [0218.798] CoGetContextToken (in: pToken=0x559de48 | out: pToken=0x559de48) returned 0x0 [0218.798] CoGetContextToken (in: pToken=0x559e250 | out: pToken=0x559e250) returned 0x0 [0218.798] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ffec10, riid=0x7463fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e2e0 | out: ppvObject=0x559e2e0*=0x0) returned 0x80004002 [0218.798] WbemDefPath:IUnknown:Release (This=0x5ffec10) returned 0x2 [0218.798] WbemDefPath:IUnknown:Release (This=0x5ffec10) returned 0x1 [0218.799] CoGetContextToken (in: pToken=0x559ebd8 | out: pToken=0x559ebd8) returned 0x0 [0218.799] CoGetContextToken (in: pToken=0x559eb38 | out: pToken=0x559eb38) returned 0x0 [0218.799] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ffec10, riid=0x559ec08*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x559ec04 | out: ppvObject=0x559ec04*=0x5ffec10) returned 0x0 [0218.799] WbemDefPath:IUnknown:AddRef (This=0x5ffec10) returned 0x3 [0218.799] WbemDefPath:IUnknown:Release (This=0x5ffec10) returned 0x2 [0218.799] WbemDefPath:IWbemPath:SetText (This=0x5ffec10, uMode=0x4, pszPath="\\\\XDUWTFONO\\root\\SecurityCenter2") returned 0x0 [0218.799] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5ffec10, puCount=0x559ed84 | out: puCount=0x559ed84*=0x2) returned 0x0 [0218.799] WbemDefPath:IWbemPath:GetText (in: This=0x5ffec10, lFlags=4, puBuffLength=0x559ed80*=0x0, pszText=0x0 | out: puBuffLength=0x559ed80*=0x21, pszText=0x0) returned 0x0 [0218.799] WbemDefPath:IWbemPath:GetText (in: This=0x5ffec10, lFlags=4, puBuffLength=0x559ed80*=0x21, pszText="00000000000000000000000000000000" | out: puBuffLength=0x559ed80*=0x21, pszText="\\\\XDUWTFONO\\root\\SecurityCenter2") returned 0x0 [0218.799] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5ffec10, puCount=0x559ed70 | out: puCount=0x559ed70*=0x2) returned 0x0 [0218.799] WbemDefPath:IWbemPath:GetText (in: This=0x5ffec10, lFlags=4, puBuffLength=0x559ed6c*=0x0, pszText=0x0 | out: puBuffLength=0x559ed6c*=0x21, pszText=0x0) returned 0x0 [0218.799] WbemDefPath:IWbemPath:GetText (in: This=0x5ffec10, lFlags=4, puBuffLength=0x559ed6c*=0x21, pszText="00000000000000000000000000000000" | out: puBuffLength=0x559ed6c*=0x21, pszText="\\\\XDUWTFONO\\root\\SecurityCenter2") returned 0x0 [0218.799] CoGetObjectContext (in: riid=0x24bbd70*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x559ed04 | out: ppv=0x559ed04*=0x98faac) returned 0x0 [0218.799] IComThreadingInfo:GetCurrentApartmentType (in: This=0x98faac, pAptType=0x559ecfc | out: pAptType=0x559ecfc*=1) returned 0x0 [0218.799] IUnknown:QueryInterface (in: This=0x98faac, riid=0x24bbd58*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x559ed00 | out: ppvObject=0x559ed00*=0x0) returned 0x80004002 [0218.799] IUnknown:Release (This=0x98faac) returned 0x1 [0218.800] CoGetClassObject (in: rclsid=0xa2264c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7459d1fc*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x559e920 | out: ppv=0x559e920*=0x5fef668) returned 0x0 [0218.800] WbemLocator:IUnknown:QueryInterface (in: This=0x5fef668, riid=0x745d0ae0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x559eb38 | out: ppvObject=0x559eb38*=0x0) returned 0x80004002 [0218.800] WbemLocator:IClassFactory:CreateInstance (in: This=0x5fef668, pUnkOuter=0x0, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559eb4c | out: ppvObject=0x559eb4c*=0x5ffecf0) returned 0x0 [0218.800] WbemLocator:IUnknown:Release (This=0x5fef668) returned 0x0 [0218.800] WbemLocator:IUnknown:QueryInterface (in: This=0x5ffecf0, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e76c | out: ppvObject=0x559e76c*=0x5ffecf0) returned 0x0 [0218.800] WbemLocator:IUnknown:QueryInterface (in: This=0x5ffecf0, riid=0x7463fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x559e728 | out: ppvObject=0x559e728*=0x0) returned 0x80004002 [0218.800] WbemLocator:IUnknown:AddRef (This=0x5ffecf0) returned 0x3 [0218.800] WbemLocator:IUnknown:QueryInterface (in: This=0x5ffecf0, riid=0x7463f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x559e084 | out: ppvObject=0x559e084*=0x0) returned 0x80004002 [0218.800] WbemLocator:IUnknown:QueryInterface (in: This=0x5ffecf0, riid=0x7463f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x559e034 | out: ppvObject=0x559e034*=0x0) returned 0x80004002 [0218.800] WbemLocator:IUnknown:QueryInterface (in: This=0x5ffecf0, riid=0x7462c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e040 | out: ppvObject=0x559e040*=0x0) returned 0x80004002 [0218.800] CoGetContextToken (in: pToken=0x559e0a0 | out: pToken=0x559e0a0) returned 0x0 [0218.800] CoGetContextToken (in: pToken=0x559e4a8 | out: pToken=0x559e4a8) returned 0x0 [0218.800] WbemLocator:IUnknown:QueryInterface (in: This=0x5ffecf0, riid=0x7463fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e538 | out: ppvObject=0x559e538*=0x0) returned 0x80004002 [0218.800] WbemLocator:IUnknown:Release (This=0x5ffecf0) returned 0x2 [0218.800] WbemLocator:IUnknown:Release (This=0x5ffecf0) returned 0x1 [0218.800] CoGetContextToken (in: pToken=0x559eb18 | out: pToken=0x559eb18) returned 0x0 [0218.800] CoGetContextToken (in: pToken=0x559ea78 | out: pToken=0x559ea78) returned 0x0 [0218.800] WbemLocator:IUnknown:QueryInterface (in: This=0x5ffecf0, riid=0x559eb48*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x559eb44 | out: ppvObject=0x559eb44*=0x5ffecf0) returned 0x0 [0218.800] WbemLocator:IUnknown:AddRef (This=0x5ffecf0) returned 0x3 [0218.800] WbemLocator:IUnknown:Release (This=0x5ffecf0) returned 0x2 [0218.800] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5ffec10, puCount=0x559ece0 | out: puCount=0x559ece0*=0x2) returned 0x0 [0218.801] WbemDefPath:IWbemPath:GetText (in: This=0x5ffec10, lFlags=8, puBuffLength=0x559ecdc*=0x0, pszText=0x0 | out: puBuffLength=0x559ecdc*=0x21, pszText=0x0) returned 0x0 [0218.801] WbemDefPath:IWbemPath:GetText (in: This=0x5ffec10, lFlags=8, puBuffLength=0x559ecdc*=0x21, pszText="00000000000000000000000000000000" | out: puBuffLength=0x559ecdc*=0x21, pszText="\\\\XDUWTFONO\\root\\SecurityCenter2") returned 0x0 [0218.801] CoCreateInstance (in: rclsid=0x6ed41284*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6ed412e4*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x559eb94 | out: ppv=0x559eb94*=0x5ffed00) returned 0x0 [0218.801] WbemLocator:IWbemLocator:ConnectServer (in: This=0x5ffed00, strNetworkResource="\\\\XDUWTFONO\\root\\SecurityCenter2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x559ec4c | out: ppNamespace=0x559ec4c*=0x5ffecc4) returned 0x0 [0218.812] WbemLocator:IUnknown:QueryInterface (in: This=0x5ffecc4, riid=0x6ed41104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559eac4 | out: ppvObject=0x559eac4*=0x9fb0bc) returned 0x0 [0218.813] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x9fb0bc, pProxy=0x5ffecc4, pAuthnSvc=0x559eb14, pAuthzSvc=0x559eb10, pServerPrincName=0x559eb08, pAuthnLevel=0x559eb0c, pImpLevel=0x559eafc, pAuthInfo=0x559eb00, pCapabilites=0x559eb04 | out: pAuthnSvc=0x559eb14*=0xa, pAuthzSvc=0x559eb10*=0x0, pServerPrincName=0x559eb08, pAuthnLevel=0x559eb0c*=0x6, pImpLevel=0x559eafc*=0x2, pAuthInfo=0x559eb00, pCapabilites=0x559eb04*=0x1) returned 0x0 [0218.813] WbemLocator:IUnknown:Release (This=0x9fb0bc) returned 0x1 [0218.813] WbemLocator:IUnknown:QueryInterface (in: This=0x5ffecc4, riid=0x6ed410f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559eab8 | out: ppvObject=0x559eab8*=0x9fb0dc) returned 0x0 [0218.813] WbemLocator:IUnknown:QueryInterface (in: This=0x5ffecc4, riid=0x6ed41104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559eab4 | out: ppvObject=0x559eab4*=0x9fb0bc) returned 0x0 [0218.813] WbemLocator:IClientSecurity:SetBlanket (This=0x9fb0bc, pProxy=0x5ffecc4, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0218.813] WbemLocator:IUnknown:Release (This=0x9fb0bc) returned 0x2 [0218.813] WbemLocator:IUnknown:Release (This=0x9fb0dc) returned 0x1 [0218.813] CoTaskMemFree (pv=0xa22a90) [0218.813] WbemLocator:IUnknown:Release (This=0x5ffed00) returned 0x0 [0218.813] WbemLocator:IUnknown:QueryInterface (in: This=0x5ffecc4, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e6b4 | out: ppvObject=0x559e6b4*=0x9fb0dc) returned 0x0 [0218.813] WbemLocator:IUnknown:QueryInterface (in: This=0x9fb0dc, riid=0x7463fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x559e670 | out: ppvObject=0x559e670*=0x0) returned 0x80004002 [0218.813] WbemLocator:IUnknown:QueryInterface (in: This=0x9fb0dc, riid=0x7463fe90*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x559e48c | out: ppvObject=0x559e48c*=0x0) returned 0x80004002 [0218.814] WbemLocator:IUnknown:AddRef (This=0x9fb0dc) returned 0x3 [0218.814] WbemLocator:IUnknown:QueryInterface (in: This=0x9fb0dc, riid=0x7463f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x559dfcc | out: ppvObject=0x559dfcc*=0x0) returned 0x80004002 [0218.814] WbemLocator:IUnknown:QueryInterface (in: This=0x9fb0dc, riid=0x7463f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x559df7c | out: ppvObject=0x559df7c*=0x0) returned 0x80004002 [0218.814] WbemLocator:IUnknown:QueryInterface (in: This=0x9fb0dc, riid=0x7462c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559df88 | out: ppvObject=0x559df88*=0x9fb03c) returned 0x0 [0218.814] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x9fb03c, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x559df90 | out: pCid=0x559df90*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0218.814] WbemLocator:IUnknown:Release (This=0x9fb03c) returned 0x3 [0218.814] CoGetContextToken (in: pToken=0x559dfe8 | out: pToken=0x559dfe8) returned 0x0 [0218.814] CoGetContextToken (in: pToken=0x559e3f0 | out: pToken=0x559e3f0) returned 0x0 [0218.814] WbemLocator:IUnknown:QueryInterface (in: This=0x9fb0dc, riid=0x7463fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e480 | out: ppvObject=0x559e480*=0x9fb0c4) returned 0x0 [0218.814] WbemLocator:IRpcOptions:Query (in: This=0x9fb0c4, pPrx=0x9fb0dc, dwProperty=2, pdwValue=0x559e4a8 | out: pdwValue=0x559e4a8) returned 0x80004002 [0218.814] WbemLocator:IUnknown:Release (This=0x9fb0c4) returned 0x3 [0218.814] WbemLocator:IUnknown:Release (This=0x9fb0dc) returned 0x2 [0218.814] CoGetContextToken (in: pToken=0x559e9c8 | out: pToken=0x559e9c8) returned 0x0 [0218.814] CoGetContextToken (in: pToken=0x559e928 | out: pToken=0x559e928) returned 0x0 [0218.815] WbemLocator:IUnknown:QueryInterface (in: This=0x9fb0dc, riid=0x559e9f8*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x559e9f4 | out: ppvObject=0x559e9f4*=0x5ffecc4) returned 0x0 [0218.815] WbemLocator:IUnknown:AddRef (This=0x5ffecc4) returned 0x4 [0218.815] WbemLocator:IUnknown:Release (This=0x5ffecc4) returned 0x3 [0218.815] WbemLocator:IUnknown:Release (This=0x5ffecc4) returned 0x2 [0218.815] SysStringLen (param_1=0x0) returned 0x0 [0218.815] CoGetContextToken (in: pToken=0x559e9e0 | out: pToken=0x559e9e0) returned 0x0 [0218.815] WbemLocator:IUnknown:AddRef (This=0x9fb0dc) returned 0x3 [0218.815] WbemLocator:IUnknown:QueryInterface (in: This=0x9fb0dc, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e874 | out: ppvObject=0x559e874*=0x9fb0dc) returned 0x0 [0218.815] WbemLocator:IUnknown:Release (This=0x9fb0dc) returned 0x3 [0218.815] WbemLocator:IUnknown:Release (This=0x9fb0dc) returned 0x2 [0218.815] CoGetContextToken (in: pToken=0x559ead8 | out: pToken=0x559ead8) returned 0x0 [0218.815] WbemLocator:IUnknown:AddRef (This=0x5ffecc4) returned 0x3 [0218.815] IWbemServices:ExecQuery (in: This=0x5ffecc4, strQueryLanguage="WQL", strQuery="Select * from AntivirusProduct", lFlags=16, pCtx=0x0, ppEnum=0x559ece8 | out: ppEnum=0x559ece8*=0x5fff554) returned 0x0 [0218.823] IUnknown:QueryInterface (in: This=0x5fff554, riid=0x6ed41104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559eb4c | out: ppvObject=0x559eb4c*=0x5fff558) returned 0x0 [0218.823] IClientSecurity:QueryBlanket (in: This=0x5fff558, pProxy=0x5fff554, pAuthnSvc=0x559eb9c, pAuthzSvc=0x559eb98, pServerPrincName=0x559eb90, pAuthnLevel=0x559eb94, pImpLevel=0x559eb84, pAuthInfo=0x559eb88, pCapabilites=0x559eb8c | out: pAuthnSvc=0x559eb9c*=0xa, pAuthzSvc=0x559eb98*=0x0, pServerPrincName=0x559eb90, pAuthnLevel=0x559eb94*=0x6, pImpLevel=0x559eb84*=0x2, pAuthInfo=0x559eb88, pCapabilites=0x559eb8c*=0x1) returned 0x0 [0218.823] IUnknown:Release (This=0x5fff558) returned 0x1 [0218.823] IUnknown:QueryInterface (in: This=0x5fff554, riid=0x6ed410f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559eb40 | out: ppvObject=0x559eb40*=0x9fafec) returned 0x0 [0218.823] IUnknown:QueryInterface (in: This=0x5fff554, riid=0x6ed41104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559eb3c | out: ppvObject=0x559eb3c*=0x5fff558) returned 0x0 [0218.823] IClientSecurity:SetBlanket (This=0x5fff558, pProxy=0x5fff554, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0218.824] IUnknown:Release (This=0x5fff558) returned 0x2 [0218.824] WbemLocator:IUnknown:Release (This=0x9fafec) returned 0x1 [0218.824] CoTaskMemFree (pv=0xa22a60) [0218.824] IUnknown:QueryInterface (in: This=0x5fff554, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e738 | out: ppvObject=0x559e738*=0x9fafec) returned 0x0 [0218.824] WbemLocator:IUnknown:QueryInterface (in: This=0x9fafec, riid=0x7463fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x559e6f4 | out: ppvObject=0x559e6f4*=0x0) returned 0x80004002 [0218.825] WbemLocator:IUnknown:QueryInterface (in: This=0x9fafec, riid=0x7463fe90*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x559e514 | out: ppvObject=0x559e514*=0x0) returned 0x80004002 [0218.825] WbemLocator:IUnknown:AddRef (This=0x9fafec) returned 0x3 [0218.825] WbemLocator:IUnknown:QueryInterface (in: This=0x9fafec, riid=0x7463f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x559e054 | out: ppvObject=0x559e054*=0x0) returned 0x80004002 [0218.825] WbemLocator:IUnknown:QueryInterface (in: This=0x9fafec, riid=0x7463f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x559e004 | out: ppvObject=0x559e004*=0x0) returned 0x80004002 [0218.825] WbemLocator:IUnknown:QueryInterface (in: This=0x9fafec, riid=0x7462c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e010 | out: ppvObject=0x559e010*=0x9faf4c) returned 0x0 [0218.825] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x9faf4c, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x559e018 | out: pCid=0x559e018*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0218.825] WbemLocator:IUnknown:Release (This=0x9faf4c) returned 0x3 [0218.825] CoGetContextToken (in: pToken=0x559e070 | out: pToken=0x559e070) returned 0x0 [0218.825] CoGetContextToken (in: pToken=0x559e478 | out: pToken=0x559e478) returned 0x0 [0218.825] WbemLocator:IUnknown:QueryInterface (in: This=0x9fafec, riid=0x7463fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e508 | out: ppvObject=0x559e508*=0x9fafd4) returned 0x0 [0218.826] WbemLocator:IRpcOptions:Query (in: This=0x9fafd4, pPrx=0x9fafec, dwProperty=2, pdwValue=0x559e530 | out: pdwValue=0x559e530) returned 0x80004002 [0218.826] WbemLocator:IUnknown:Release (This=0x9fafd4) returned 0x3 [0218.826] WbemLocator:IUnknown:Release (This=0x9fafec) returned 0x2 [0218.826] CoGetContextToken (in: pToken=0x559ea48 | out: pToken=0x559ea48) returned 0x0 [0218.826] CoGetContextToken (in: pToken=0x559e9a8 | out: pToken=0x559e9a8) returned 0x0 [0218.826] WbemLocator:IUnknown:QueryInterface (in: This=0x9fafec, riid=0x559ea78*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x559ea74 | out: ppvObject=0x559ea74*=0x5fff554) returned 0x0 [0218.826] IUnknown:AddRef (This=0x5fff554) returned 0x4 [0218.826] IUnknown:Release (This=0x5fff554) returned 0x3 [0218.826] IUnknown:Release (This=0x5fff554) returned 0x2 [0218.826] WbemLocator:IUnknown:Release (This=0x5ffecc4) returned 0x2 [0218.826] SysStringLen (param_1=0x0) returned 0x0 [0218.826] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5ffec10, puCount=0x559ed34 | out: puCount=0x559ed34*=0x2) returned 0x0 [0218.826] WbemDefPath:IWbemPath:GetText (in: This=0x5ffec10, lFlags=4, puBuffLength=0x559ed30*=0x0, pszText=0x0 | out: puBuffLength=0x559ed30*=0x21, pszText=0x0) returned 0x0 [0218.826] WbemDefPath:IWbemPath:GetText (in: This=0x5ffec10, lFlags=4, puBuffLength=0x559ed30*=0x21, pszText="00000000000000000000000000000000" | out: puBuffLength=0x559ed30*=0x21, pszText="\\\\XDUWTFONO\\root\\SecurityCenter2") returned 0x0 [0218.826] CoGetContextToken (in: pToken=0x559eb80 | out: pToken=0x559eb80) returned 0x0 [0218.826] IUnknown:AddRef (This=0x5fff554) returned 0x3 [0218.826] IEnumWbemClassObject:Clone (in: This=0x5fff554, ppEnum=0x559ed40 | out: ppEnum=0x559ed40*=0x5fff2fc) returned 0x0 [0218.827] IUnknown:QueryInterface (in: This=0x5fff2fc, riid=0x6ed41104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559ec04 | out: ppvObject=0x559ec04*=0x5fff300) returned 0x0 [0218.827] IClientSecurity:QueryBlanket (in: This=0x5fff300, pProxy=0x5fff2fc, pAuthnSvc=0x559ec54, pAuthzSvc=0x559ec50, pServerPrincName=0x559ec48, pAuthnLevel=0x559ec4c, pImpLevel=0x559ec3c, pAuthInfo=0x559ec40, pCapabilites=0x559ec44 | out: pAuthnSvc=0x559ec54*=0xa, pAuthzSvc=0x559ec50*=0x0, pServerPrincName=0x559ec48, pAuthnLevel=0x559ec4c*=0x6, pImpLevel=0x559ec3c*=0x2, pAuthInfo=0x559ec40, pCapabilites=0x559ec44*=0x1) returned 0x0 [0218.827] IUnknown:Release (This=0x5fff300) returned 0x1 [0218.827] IUnknown:QueryInterface (in: This=0x5fff2fc, riid=0x6ed410f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559ebf8 | out: ppvObject=0x559ebf8*=0x9fb2bc) returned 0x0 [0218.827] IUnknown:QueryInterface (in: This=0x5fff2fc, riid=0x6ed41104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559ebf4 | out: ppvObject=0x559ebf4*=0x5fff300) returned 0x0 [0218.827] IClientSecurity:SetBlanket (This=0x5fff300, pProxy=0x5fff2fc, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0218.828] IUnknown:Release (This=0x5fff300) returned 0x2 [0218.828] WbemLocator:IUnknown:Release (This=0x9fb2bc) returned 0x1 [0218.828] CoTaskMemFree (pv=0xa22a90) [0218.828] IUnknown:QueryInterface (in: This=0x5fff2fc, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e7e0 | out: ppvObject=0x559e7e0*=0x9fb2bc) returned 0x0 [0218.828] WbemLocator:IUnknown:QueryInterface (in: This=0x9fb2bc, riid=0x7463fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x559e79c | out: ppvObject=0x559e79c*=0x0) returned 0x80004002 [0218.828] WbemLocator:IUnknown:QueryInterface (in: This=0x9fb2bc, riid=0x7463fe90*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x559e5bc | out: ppvObject=0x559e5bc*=0x0) returned 0x80004002 [0218.829] WbemLocator:IUnknown:AddRef (This=0x9fb2bc) returned 0x3 [0218.829] WbemLocator:IUnknown:QueryInterface (in: This=0x9fb2bc, riid=0x7463f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x559e0fc | out: ppvObject=0x559e0fc*=0x0) returned 0x80004002 [0218.829] WbemLocator:IUnknown:QueryInterface (in: This=0x9fb2bc, riid=0x7463f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x559e0ac | out: ppvObject=0x559e0ac*=0x0) returned 0x80004002 [0218.829] WbemLocator:IUnknown:QueryInterface (in: This=0x9fb2bc, riid=0x7462c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e0b8 | out: ppvObject=0x559e0b8*=0x9fb21c) returned 0x0 [0218.829] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x9fb21c, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x559e0c0 | out: pCid=0x559e0c0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0218.829] WbemLocator:IUnknown:Release (This=0x9fb21c) returned 0x3 [0218.829] CoGetContextToken (in: pToken=0x559e118 | out: pToken=0x559e118) returned 0x0 [0218.829] CoGetContextToken (in: pToken=0x559e520 | out: pToken=0x559e520) returned 0x0 [0218.829] WbemLocator:IUnknown:QueryInterface (in: This=0x9fb2bc, riid=0x7463fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e5b0 | out: ppvObject=0x559e5b0*=0x9fb2a4) returned 0x0 [0218.829] WbemLocator:IRpcOptions:Query (in: This=0x9fb2a4, pPrx=0x9fb2bc, dwProperty=2, pdwValue=0x559e5d8 | out: pdwValue=0x559e5d8) returned 0x80004002 [0218.829] WbemLocator:IUnknown:Release (This=0x9fb2a4) returned 0x3 [0218.829] WbemLocator:IUnknown:Release (This=0x9fb2bc) returned 0x2 [0218.829] CoGetContextToken (in: pToken=0x559eaf0 | out: pToken=0x559eaf0) returned 0x0 [0218.829] CoGetContextToken (in: pToken=0x559ea50 | out: pToken=0x559ea50) returned 0x0 [0218.829] WbemLocator:IUnknown:QueryInterface (in: This=0x9fb2bc, riid=0x559eb20*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x559eb1c | out: ppvObject=0x559eb1c*=0x5fff2fc) returned 0x0 [0218.829] IUnknown:AddRef (This=0x5fff2fc) returned 0x4 [0218.829] IUnknown:Release (This=0x5fff2fc) returned 0x3 [0218.829] IUnknown:Release (This=0x5fff2fc) returned 0x2 [0218.830] IUnknown:Release (This=0x5fff554) returned 0x2 [0218.830] SysStringLen (param_1=0x0) returned 0x0 [0218.830] IEnumWbemClassObject:Reset (This=0x5fff2fc) returned 0x0 [0218.830] CoTaskMemAlloc (cb=0x4) returned 0x609b848 [0218.830] IEnumWbemClassObject:Next (in: This=0x5fff2fc, lTimeout=-1, uCount=0x1, apObjects=0x609b848, puReturned=0x253211c | out: apObjects=0x609b848*=0x0, puReturned=0x253211c*=0x0) returned 0x1 [0218.830] CoTaskMemFree (pv=0x609b848) [0218.830] CoGetContextToken (in: pToken=0x559ec68 | out: pToken=0x559ec68) returned 0x0 [0218.830] WbemLocator:IUnknown:Release (This=0x9fb2bc) returned 0x1 [0218.830] IUnknown:Release (This=0x5fff2fc) returned 0x0 [0218.845] CoGetObjectContext (in: riid=0x24bbd70*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x559ed5c | out: ppv=0x559ed5c*=0x98faac) returned 0x0 [0218.845] IComThreadingInfo:GetCurrentApartmentType (in: This=0x98faac, pAptType=0x559ed54 | out: pAptType=0x559ed54*=1) returned 0x0 [0218.845] IUnknown:QueryInterface (in: This=0x98faac, riid=0x24bbd58*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x559ed58 | out: ppvObject=0x559ed58*=0x0) returned 0x80004002 [0218.845] IUnknown:Release (This=0x98faac) returned 0x1 [0218.846] CoGetClassObject (in: rclsid=0xa2255c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7459d1fc*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x559e6c8 | out: ppv=0x559e6c8*=0x5ffed00) returned 0x0 [0218.846] WbemDefPath:IUnknown:QueryInterface (in: This=0x5ffed00, riid=0x745d0ae0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x559e8e0 | out: ppvObject=0x559e8e0*=0x0) returned 0x80004002 [0218.846] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5ffed00, pUnkOuter=0x0, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e8f4 | out: ppvObject=0x559e8f4*=0x5fff270) returned 0x0 [0218.846] WbemDefPath:IUnknown:Release (This=0x5ffed00) returned 0x0 [0218.846] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fff270, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e514 | out: ppvObject=0x559e514*=0x5fff270) returned 0x0 [0218.847] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fff270, riid=0x7463fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x559e4d0 | out: ppvObject=0x559e4d0*=0x0) returned 0x80004002 [0218.847] WbemDefPath:IUnknown:AddRef (This=0x5fff270) returned 0x3 [0218.847] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fff270, riid=0x7463f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x559de2c | out: ppvObject=0x559de2c*=0x0) returned 0x80004002 [0218.847] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fff270, riid=0x7463f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x559dddc | out: ppvObject=0x559dddc*=0x0) returned 0x80004002 [0218.847] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fff270, riid=0x7462c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559dde8 | out: ppvObject=0x559dde8*=0x609b848) returned 0x0 [0218.847] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x609b848, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x559ddf0 | out: pCid=0x559ddf0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0218.847] WbemDefPath:IUnknown:Release (This=0x609b848) returned 0x3 [0218.847] CoGetContextToken (in: pToken=0x559de48 | out: pToken=0x559de48) returned 0x0 [0218.847] CoGetContextToken (in: pToken=0x559e250 | out: pToken=0x559e250) returned 0x0 [0218.847] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fff270, riid=0x7463fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e2e0 | out: ppvObject=0x559e2e0*=0x0) returned 0x80004002 [0218.847] WbemDefPath:IUnknown:Release (This=0x5fff270) returned 0x2 [0218.847] WbemDefPath:IUnknown:Release (This=0x5fff270) returned 0x1 [0218.847] CoGetContextToken (in: pToken=0x559ebd8 | out: pToken=0x559ebd8) returned 0x0 [0218.847] CoGetContextToken (in: pToken=0x559eb38 | out: pToken=0x559eb38) returned 0x0 [0218.847] WbemDefPath:IUnknown:QueryInterface (in: This=0x5fff270, riid=0x559ec08*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x559ec04 | out: ppvObject=0x559ec04*=0x5fff270) returned 0x0 [0218.847] WbemDefPath:IUnknown:AddRef (This=0x5fff270) returned 0x3 [0218.847] WbemDefPath:IUnknown:Release (This=0x5fff270) returned 0x2 [0218.847] WbemDefPath:IWbemPath:SetText (This=0x5fff270, uMode=0x4, pszPath="root\\SecurityCenter2") returned 0x0 [0218.847] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5fff270, puCount=0x559ed84 | out: puCount=0x559ed84*=0x2) returned 0x0 [0218.847] WbemDefPath:IWbemPath:GetText (in: This=0x5fff270, lFlags=4, puBuffLength=0x559ed80*=0x0, pszText=0x0 | out: puBuffLength=0x559ed80*=0x19, pszText=0x0) returned 0x0 [0218.847] WbemDefPath:IWbemPath:GetText (in: This=0x5fff270, lFlags=4, puBuffLength=0x559ed80*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x559ed80*=0x19, pszText="\\\\.\\root\\SecurityCenter2") returned 0x0 [0218.847] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5fff270, puCount=0x559ed70 | out: puCount=0x559ed70*=0x2) returned 0x0 [0218.847] WbemDefPath:IWbemPath:GetText (in: This=0x5fff270, lFlags=4, puBuffLength=0x559ed6c*=0x0, pszText=0x0 | out: puBuffLength=0x559ed6c*=0x19, pszText=0x0) returned 0x0 [0218.847] WbemDefPath:IWbemPath:GetText (in: This=0x5fff270, lFlags=4, puBuffLength=0x559ed6c*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x559ed6c*=0x19, pszText="\\\\.\\root\\SecurityCenter2") returned 0x0 [0218.847] CoGetObjectContext (in: riid=0x24bbd70*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x559ed04 | out: ppv=0x559ed04*=0x98faac) returned 0x0 [0218.848] IComThreadingInfo:GetCurrentApartmentType (in: This=0x98faac, pAptType=0x559ecfc | out: pAptType=0x559ecfc*=1) returned 0x0 [0218.848] IUnknown:QueryInterface (in: This=0x98faac, riid=0x24bbd58*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x559ed00 | out: ppvObject=0x559ed00*=0x0) returned 0x80004002 [0218.848] IUnknown:Release (This=0x98faac) returned 0x1 [0218.848] CoGetClassObject (in: rclsid=0xa2264c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7459d1fc*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x559e920 | out: ppv=0x559e920*=0x5fef6b0) returned 0x0 [0218.848] WbemLocator:IUnknown:QueryInterface (in: This=0x5fef6b0, riid=0x745d0ae0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x559eb38 | out: ppvObject=0x559eb38*=0x0) returned 0x80004002 [0218.848] WbemLocator:IClassFactory:CreateInstance (in: This=0x5fef6b0, pUnkOuter=0x0, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559eb4c | out: ppvObject=0x559eb4c*=0x5ffed10) returned 0x0 [0218.848] WbemLocator:IUnknown:Release (This=0x5fef6b0) returned 0x0 [0218.848] WbemLocator:IUnknown:QueryInterface (in: This=0x5ffed10, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e76c | out: ppvObject=0x559e76c*=0x5ffed10) returned 0x0 [0218.848] WbemLocator:IUnknown:QueryInterface (in: This=0x5ffed10, riid=0x7463fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x559e728 | out: ppvObject=0x559e728*=0x0) returned 0x80004002 [0218.849] WbemLocator:IUnknown:AddRef (This=0x5ffed10) returned 0x3 [0218.849] WbemLocator:IUnknown:QueryInterface (in: This=0x5ffed10, riid=0x7463f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x559e084 | out: ppvObject=0x559e084*=0x0) returned 0x80004002 [0218.849] WbemLocator:IUnknown:QueryInterface (in: This=0x5ffed10, riid=0x7463f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x559e034 | out: ppvObject=0x559e034*=0x0) returned 0x80004002 [0218.849] WbemLocator:IUnknown:QueryInterface (in: This=0x5ffed10, riid=0x7462c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e040 | out: ppvObject=0x559e040*=0x0) returned 0x80004002 [0218.849] CoGetContextToken (in: pToken=0x559e0a0 | out: pToken=0x559e0a0) returned 0x0 [0218.849] CoGetContextToken (in: pToken=0x559e4a8 | out: pToken=0x559e4a8) returned 0x0 [0218.849] WbemLocator:IUnknown:QueryInterface (in: This=0x5ffed10, riid=0x7463fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e538 | out: ppvObject=0x559e538*=0x0) returned 0x80004002 [0218.849] WbemLocator:IUnknown:Release (This=0x5ffed10) returned 0x2 [0218.849] WbemLocator:IUnknown:Release (This=0x5ffed10) returned 0x1 [0218.849] CoGetContextToken (in: pToken=0x559eb18 | out: pToken=0x559eb18) returned 0x0 [0218.849] CoGetContextToken (in: pToken=0x559ea78 | out: pToken=0x559ea78) returned 0x0 [0218.849] WbemLocator:IUnknown:QueryInterface (in: This=0x5ffed10, riid=0x559eb48*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x559eb44 | out: ppvObject=0x559eb44*=0x5ffed10) returned 0x0 [0218.849] WbemLocator:IUnknown:AddRef (This=0x5ffed10) returned 0x3 [0218.849] WbemLocator:IUnknown:Release (This=0x5ffed10) returned 0x2 [0218.849] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5fff270, puCount=0x559ece0 | out: puCount=0x559ece0*=0x2) returned 0x0 [0218.849] WbemDefPath:IWbemPath:GetText (in: This=0x5fff270, lFlags=8, puBuffLength=0x559ecdc*=0x0, pszText=0x0 | out: puBuffLength=0x559ecdc*=0x19, pszText=0x0) returned 0x0 [0218.849] WbemDefPath:IWbemPath:GetText (in: This=0x5fff270, lFlags=8, puBuffLength=0x559ecdc*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x559ecdc*=0x19, pszText="\\\\.\\root\\SecurityCenter2") returned 0x0 [0218.849] CoCreateInstance (in: rclsid=0x6ed41284*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6ed412e4*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x559eba4 | out: ppv=0x559eba4*=0x5ffed20) returned 0x0 [0218.849] WbemLocator:IWbemLocator:ConnectServer (in: This=0x5ffed20, strNetworkResource="\\\\.\\root\\SecurityCenter2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x559ec4c | out: ppNamespace=0x559ec4c*=0x5fff3a4) returned 0x0 [0218.861] WbemLocator:IUnknown:QueryInterface (in: This=0x5fff3a4, riid=0x6ed41104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559ead4 | out: ppvObject=0x559ead4*=0x9fb38c) returned 0x0 [0218.861] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x9fb38c, pProxy=0x5fff3a4, pAuthnSvc=0x559eb24, pAuthzSvc=0x559eb20, pServerPrincName=0x559eb18, pAuthnLevel=0x559eb1c, pImpLevel=0x559eb0c, pAuthInfo=0x559eb10, pCapabilites=0x559eb14 | out: pAuthnSvc=0x559eb24*=0xa, pAuthzSvc=0x559eb20*=0x0, pServerPrincName=0x559eb18, pAuthnLevel=0x559eb1c*=0x6, pImpLevel=0x559eb0c*=0x2, pAuthInfo=0x559eb10, pCapabilites=0x559eb14*=0x1) returned 0x0 [0218.861] WbemLocator:IUnknown:Release (This=0x9fb38c) returned 0x1 [0218.861] WbemLocator:IUnknown:QueryInterface (in: This=0x5fff3a4, riid=0x6ed410f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559eac8 | out: ppvObject=0x559eac8*=0x9fb3ac) returned 0x0 [0218.862] WbemLocator:IUnknown:QueryInterface (in: This=0x5fff3a4, riid=0x6ed41104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559eac4 | out: ppvObject=0x559eac4*=0x9fb38c) returned 0x0 [0218.862] WbemLocator:IClientSecurity:SetBlanket (This=0x9fb38c, pProxy=0x5fff3a4, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0218.862] WbemLocator:IUnknown:Release (This=0x9fb38c) returned 0x2 [0218.862] WbemLocator:IUnknown:Release (This=0x9fb3ac) returned 0x1 [0218.862] CoTaskMemFree (pv=0xa22a60) [0218.862] WbemLocator:IUnknown:Release (This=0x5ffed20) returned 0x0 [0218.862] WbemLocator:IUnknown:QueryInterface (in: This=0x5fff3a4, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e6c4 | out: ppvObject=0x559e6c4*=0x9fb3ac) returned 0x0 [0218.862] WbemLocator:IUnknown:QueryInterface (in: This=0x9fb3ac, riid=0x7463fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x559e680 | out: ppvObject=0x559e680*=0x0) returned 0x80004002 [0218.865] WbemLocator:IUnknown:QueryInterface (in: This=0x9fb3ac, riid=0x7463fe90*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x559e49c | out: ppvObject=0x559e49c*=0x0) returned 0x80004002 [0218.865] WbemLocator:IUnknown:AddRef (This=0x9fb3ac) returned 0x3 [0218.865] WbemLocator:IUnknown:QueryInterface (in: This=0x9fb3ac, riid=0x7463f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x559dfdc | out: ppvObject=0x559dfdc*=0x0) returned 0x80004002 [0218.865] WbemLocator:IUnknown:QueryInterface (in: This=0x9fb3ac, riid=0x7463f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x559df8c | out: ppvObject=0x559df8c*=0x0) returned 0x80004002 [0218.865] WbemLocator:IUnknown:QueryInterface (in: This=0x9fb3ac, riid=0x7462c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559df98 | out: ppvObject=0x559df98*=0x9fb30c) returned 0x0 [0218.865] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x9fb30c, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x559dfa0 | out: pCid=0x559dfa0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0218.865] WbemLocator:IUnknown:Release (This=0x9fb30c) returned 0x3 [0218.865] CoGetContextToken (in: pToken=0x559dff8 | out: pToken=0x559dff8) returned 0x0 [0218.866] CoGetContextToken (in: pToken=0x559e400 | out: pToken=0x559e400) returned 0x0 [0218.866] WbemLocator:IUnknown:QueryInterface (in: This=0x9fb3ac, riid=0x7463fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e490 | out: ppvObject=0x559e490*=0x9fb394) returned 0x0 [0218.866] WbemLocator:IRpcOptions:Query (in: This=0x9fb394, pPrx=0x9fb3ac, dwProperty=2, pdwValue=0x559e4b8 | out: pdwValue=0x559e4b8) returned 0x80004002 [0218.866] WbemLocator:IUnknown:Release (This=0x9fb394) returned 0x3 [0218.866] WbemLocator:IUnknown:Release (This=0x9fb3ac) returned 0x2 [0218.866] CoGetContextToken (in: pToken=0x559e9d8 | out: pToken=0x559e9d8) returned 0x0 [0218.866] CoGetContextToken (in: pToken=0x559e938 | out: pToken=0x559e938) returned 0x0 [0218.866] WbemLocator:IUnknown:QueryInterface (in: This=0x9fb3ac, riid=0x559ea08*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x559ea04 | out: ppvObject=0x559ea04*=0x5fff3a4) returned 0x0 [0218.866] WbemLocator:IUnknown:AddRef (This=0x5fff3a4) returned 0x4 [0218.866] WbemLocator:IUnknown:Release (This=0x5fff3a4) returned 0x3 [0218.866] WbemLocator:IUnknown:Release (This=0x5fff3a4) returned 0x2 [0218.866] SysStringLen (param_1=0x0) returned 0x0 [0218.866] CoGetContextToken (in: pToken=0x559e9e0 | out: pToken=0x559e9e0) returned 0x0 [0218.866] WbemLocator:IUnknown:AddRef (This=0x9fb3ac) returned 0x3 [0218.866] WbemLocator:IUnknown:QueryInterface (in: This=0x9fb3ac, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e874 | out: ppvObject=0x559e874*=0x9fb3ac) returned 0x0 [0218.866] WbemLocator:IUnknown:Release (This=0x9fb3ac) returned 0x3 [0218.866] WbemLocator:IUnknown:Release (This=0x9fb3ac) returned 0x2 [0218.866] CoGetContextToken (in: pToken=0x559ead8 | out: pToken=0x559ead8) returned 0x0 [0218.866] WbemLocator:IUnknown:AddRef (This=0x5fff3a4) returned 0x3 [0218.866] IWbemServices:ExecQuery (in: This=0x5fff3a4, strQueryLanguage="WQL", strQuery="SELECT * FROM FirewallProduct", lFlags=16, pCtx=0x0, ppEnum=0x559ece8 | out: ppEnum=0x559ece8*=0x5ffd1cc) returned 0x0 [0218.869] IUnknown:QueryInterface (in: This=0x5ffd1cc, riid=0x6ed41104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559eb4c | out: ppvObject=0x559eb4c*=0x5ffd1d0) returned 0x0 [0218.869] IClientSecurity:QueryBlanket (in: This=0x5ffd1d0, pProxy=0x5ffd1cc, pAuthnSvc=0x559eb9c, pAuthzSvc=0x559eb98, pServerPrincName=0x559eb90, pAuthnLevel=0x559eb94, pImpLevel=0x559eb84, pAuthInfo=0x559eb88, pCapabilites=0x559eb8c | out: pAuthnSvc=0x559eb9c*=0xa, pAuthzSvc=0x559eb98*=0x0, pServerPrincName=0x559eb90, pAuthnLevel=0x559eb94*=0x6, pImpLevel=0x559eb84*=0x2, pAuthInfo=0x559eb88, pCapabilites=0x559eb8c*=0x1) returned 0x0 [0218.869] IUnknown:Release (This=0x5ffd1d0) returned 0x1 [0218.869] IUnknown:QueryInterface (in: This=0x5ffd1cc, riid=0x6ed410f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559eb40 | out: ppvObject=0x559eb40*=0x9fb2bc) returned 0x0 [0218.869] IUnknown:QueryInterface (in: This=0x5ffd1cc, riid=0x6ed41104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559eb3c | out: ppvObject=0x559eb3c*=0x5ffd1d0) returned 0x0 [0218.869] IClientSecurity:SetBlanket (This=0x5ffd1d0, pProxy=0x5ffd1cc, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0218.870] IUnknown:Release (This=0x5ffd1d0) returned 0x2 [0218.870] WbemLocator:IUnknown:Release (This=0x9fb2bc) returned 0x1 [0218.870] CoTaskMemFree (pv=0xa22a90) [0218.871] IUnknown:QueryInterface (in: This=0x5ffd1cc, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e738 | out: ppvObject=0x559e738*=0x9fb2bc) returned 0x0 [0218.871] WbemLocator:IUnknown:QueryInterface (in: This=0x9fb2bc, riid=0x7463fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x559e6f4 | out: ppvObject=0x559e6f4*=0x0) returned 0x80004002 [0218.871] WbemLocator:IUnknown:QueryInterface (in: This=0x9fb2bc, riid=0x7463fe90*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x559e514 | out: ppvObject=0x559e514*=0x0) returned 0x80004002 [0218.871] WbemLocator:IUnknown:AddRef (This=0x9fb2bc) returned 0x3 [0218.871] WbemLocator:IUnknown:QueryInterface (in: This=0x9fb2bc, riid=0x7463f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x559e054 | out: ppvObject=0x559e054*=0x0) returned 0x80004002 [0218.871] WbemLocator:IUnknown:QueryInterface (in: This=0x9fb2bc, riid=0x7463f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x559e004 | out: ppvObject=0x559e004*=0x0) returned 0x80004002 [0218.871] WbemLocator:IUnknown:QueryInterface (in: This=0x9fb2bc, riid=0x7462c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e010 | out: ppvObject=0x559e010*=0x9fb21c) returned 0x0 [0218.872] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x9fb21c, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x559e018 | out: pCid=0x559e018*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0218.872] WbemLocator:IUnknown:Release (This=0x9fb21c) returned 0x3 [0218.872] CoGetContextToken (in: pToken=0x559e070 | out: pToken=0x559e070) returned 0x0 [0218.872] CoGetContextToken (in: pToken=0x559e478 | out: pToken=0x559e478) returned 0x0 [0218.872] WbemLocator:IUnknown:QueryInterface (in: This=0x9fb2bc, riid=0x7463fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e508 | out: ppvObject=0x559e508*=0x9fb2a4) returned 0x0 [0218.872] WbemLocator:IRpcOptions:Query (in: This=0x9fb2a4, pPrx=0x9fb2bc, dwProperty=2, pdwValue=0x559e530 | out: pdwValue=0x559e530) returned 0x80004002 [0218.872] WbemLocator:IUnknown:Release (This=0x9fb2a4) returned 0x3 [0218.872] WbemLocator:IUnknown:Release (This=0x9fb2bc) returned 0x2 [0218.872] CoGetContextToken (in: pToken=0x559ea48 | out: pToken=0x559ea48) returned 0x0 [0218.872] CoGetContextToken (in: pToken=0x559e9a8 | out: pToken=0x559e9a8) returned 0x0 [0218.872] WbemLocator:IUnknown:QueryInterface (in: This=0x9fb2bc, riid=0x559ea78*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x559ea74 | out: ppvObject=0x559ea74*=0x5ffd1cc) returned 0x0 [0218.872] IUnknown:AddRef (This=0x5ffd1cc) returned 0x4 [0218.872] IUnknown:Release (This=0x5ffd1cc) returned 0x3 [0218.872] IUnknown:Release (This=0x5ffd1cc) returned 0x2 [0218.872] WbemLocator:IUnknown:Release (This=0x5fff3a4) returned 0x2 [0218.872] SysStringLen (param_1=0x0) returned 0x0 [0218.872] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5fff270, puCount=0x559ed34 | out: puCount=0x559ed34*=0x2) returned 0x0 [0218.872] WbemDefPath:IWbemPath:GetText (in: This=0x5fff270, lFlags=4, puBuffLength=0x559ed30*=0x0, pszText=0x0 | out: puBuffLength=0x559ed30*=0x19, pszText=0x0) returned 0x0 [0218.873] WbemDefPath:IWbemPath:GetText (in: This=0x5fff270, lFlags=4, puBuffLength=0x559ed30*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x559ed30*=0x19, pszText="\\\\.\\root\\SecurityCenter2") returned 0x0 [0218.873] CoGetContextToken (in: pToken=0x559eb80 | out: pToken=0x559eb80) returned 0x0 [0218.873] IUnknown:AddRef (This=0x5ffd1cc) returned 0x3 [0218.873] IEnumWbemClassObject:Clone (in: This=0x5ffd1cc, ppEnum=0x559ed40 | out: ppEnum=0x559ed40*=0x5ffd294) returned 0x0 [0218.873] IUnknown:QueryInterface (in: This=0x5ffd294, riid=0x6ed41104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559ec04 | out: ppvObject=0x559ec04*=0x5ffd298) returned 0x0 [0218.873] IClientSecurity:QueryBlanket (in: This=0x5ffd298, pProxy=0x5ffd294, pAuthnSvc=0x559ec54, pAuthzSvc=0x559ec50, pServerPrincName=0x559ec48, pAuthnLevel=0x559ec4c, pImpLevel=0x559ec3c, pAuthInfo=0x559ec40, pCapabilites=0x559ec44 | out: pAuthnSvc=0x559ec54*=0xa, pAuthzSvc=0x559ec50*=0x0, pServerPrincName=0x559ec48, pAuthnLevel=0x559ec4c*=0x6, pImpLevel=0x559ec3c*=0x2, pAuthInfo=0x559ec40, pCapabilites=0x559ec44*=0x1) returned 0x0 [0218.873] IUnknown:Release (This=0x5ffd298) returned 0x1 [0218.873] IUnknown:QueryInterface (in: This=0x5ffd294, riid=0x6ed410f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559ebf8 | out: ppvObject=0x559ebf8*=0x9fb58c) returned 0x0 [0218.873] IUnknown:QueryInterface (in: This=0x5ffd294, riid=0x6ed41104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559ebf4 | out: ppvObject=0x559ebf4*=0x5ffd298) returned 0x0 [0218.873] IClientSecurity:SetBlanket (This=0x5ffd298, pProxy=0x5ffd294, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0218.874] IUnknown:Release (This=0x5ffd298) returned 0x2 [0218.874] WbemLocator:IUnknown:Release (This=0x9fb58c) returned 0x1 [0218.874] CoTaskMemFree (pv=0xa22a60) [0218.875] IUnknown:QueryInterface (in: This=0x5ffd294, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e7e0 | out: ppvObject=0x559e7e0*=0x9fb58c) returned 0x0 [0218.875] WbemLocator:IUnknown:QueryInterface (in: This=0x9fb58c, riid=0x7463fc00*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x559e79c | out: ppvObject=0x559e79c*=0x0) returned 0x80004002 [0218.875] WbemLocator:IUnknown:QueryInterface (in: This=0x9fb58c, riid=0x7463fe90*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x559e5bc | out: ppvObject=0x559e5bc*=0x0) returned 0x80004002 [0218.875] WbemLocator:IUnknown:AddRef (This=0x9fb58c) returned 0x3 [0218.875] WbemLocator:IUnknown:QueryInterface (in: This=0x9fb58c, riid=0x7463f90c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x559e0fc | out: ppvObject=0x559e0fc*=0x0) returned 0x80004002 [0218.875] WbemLocator:IUnknown:QueryInterface (in: This=0x9fb58c, riid=0x7463f860*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x559e0ac | out: ppvObject=0x559e0ac*=0x0) returned 0x80004002 [0218.876] WbemLocator:IUnknown:QueryInterface (in: This=0x9fb58c, riid=0x7462c350*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e0b8 | out: ppvObject=0x559e0b8*=0x9fb4ec) returned 0x0 [0218.876] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x9fb4ec, riid=0x7450e814*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x559e0c0 | out: pCid=0x559e0c0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0218.876] WbemLocator:IUnknown:Release (This=0x9fb4ec) returned 0x3 [0218.876] CoGetContextToken (in: pToken=0x559e118 | out: pToken=0x559e118) returned 0x0 [0218.876] CoGetContextToken (in: pToken=0x559e520 | out: pToken=0x559e520) returned 0x0 [0218.876] WbemLocator:IUnknown:QueryInterface (in: This=0x9fb58c, riid=0x7463fb48*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e5b0 | out: ppvObject=0x559e5b0*=0x9fb574) returned 0x0 [0218.876] WbemLocator:IRpcOptions:Query (in: This=0x9fb574, pPrx=0x9fb58c, dwProperty=2, pdwValue=0x559e5d8 | out: pdwValue=0x559e5d8) returned 0x80004002 [0218.876] WbemLocator:IUnknown:Release (This=0x9fb574) returned 0x3 [0218.876] WbemLocator:IUnknown:Release (This=0x9fb58c) returned 0x2 [0218.876] CoGetContextToken (in: pToken=0x559eaf0 | out: pToken=0x559eaf0) returned 0x0 [0218.876] CoGetContextToken (in: pToken=0x559ea50 | out: pToken=0x559ea50) returned 0x0 [0218.876] WbemLocator:IUnknown:QueryInterface (in: This=0x9fb58c, riid=0x559eb20*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x559eb1c | out: ppvObject=0x559eb1c*=0x5ffd294) returned 0x0 [0218.876] IUnknown:AddRef (This=0x5ffd294) returned 0x4 [0218.876] IUnknown:Release (This=0x5ffd294) returned 0x3 [0218.876] IUnknown:Release (This=0x5ffd294) returned 0x2 [0218.876] IUnknown:Release (This=0x5ffd1cc) returned 0x2 [0218.876] SysStringLen (param_1=0x0) returned 0x0 [0218.876] IEnumWbemClassObject:Reset (This=0x5ffd294) returned 0x0 [0218.876] CoTaskMemAlloc (cb=0x4) returned 0x609b8b8 [0218.877] IEnumWbemClassObject:Next (in: This=0x5ffd294, lTimeout=-1, uCount=0x1, apObjects=0x609b8b8, puReturned=0x2533188 | out: apObjects=0x609b8b8*=0x0, puReturned=0x2533188*=0x0) returned 0x1 [0218.877] CoTaskMemFree (pv=0x609b8b8) [0218.877] CoGetContextToken (in: pToken=0x559ec68 | out: pToken=0x559ec68) returned 0x0 [0218.877] WbemLocator:IUnknown:Release (This=0x9fb58c) returned 0x1 [0218.877] IUnknown:Release (This=0x5ffd294) returned 0x0 [0218.877] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x559e764, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0218.878] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Hardware & Soft.txt", nBufferLength=0x105, lpBuffer=0x559e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Hardware & Soft.txt", lpFilePart=0x0) returned 0x86 [0218.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec6c) returned 1 [0218.878] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Hardware & Soft.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\hardware & soft.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x5ec [0218.878] GetFileType (hFile=0x5ec) returned 0x1 [0218.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x559ec68) returned 1 [0218.879] GetFileType (hFile=0x5ec) returned 0x1 [0218.879] SetFilePointer (in: hFile=0x5ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x559ec40*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x559ec40*=0) returned 0x199 [0218.879] WriteFile (in: hFile=0x5ec, lpBuffer=0x2535340*, nNumberOfBytesToWrite=0x579, lpNumberOfBytesWritten=0x559ed14, lpOverlapped=0x0 | out: lpBuffer=0x2535340*, lpNumberOfBytesWritten=0x559ed14*=0x579, lpOverlapped=0x0) returned 1 [0218.880] CloseHandle (hObject=0x5ec) returned 1 [0218.901] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x559e89c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0218.902] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", nBufferLength=0x105, lpBuffer=0x559e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", lpFilePart=0x0) returned 0x72 [0218.902] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x559e89c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0218.902] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\22e94f5071aaed0706b87ec862736685-mat-debug.tmp", nBufferLength=0x105, lpBuffer=0x559e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\22e94f5071aaed0706b87ec862736685-mat-debug.tmp", lpFilePart=0x0) returned 0x80 [0218.903] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\22e94f5071aaed0706b87ec862736685-mat-debug.tmp", nBufferLength=0x105, lpBuffer=0x559e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\22e94f5071aaed0706b87ec862736685-mat-debug.tmp", lpFilePart=0x0) returned 0x80 [0218.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec7c) returned 1 [0218.903] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\22e94f5071aaed0706b87ec862736685-mat-debug.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\22e94f5071aaed0706b87ec862736685-mat-debug.tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5ec [0218.905] GetFileType (hFile=0x5ec) returned 0x1 [0218.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x559ec78) returned 1 [0218.905] GetFileType (hFile=0x5ec) returned 0x1 [0218.909] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", nBufferLength=0x105, lpBuffer=0x559e888, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", lpFilePart=0x0) returned 0x72 [0218.909] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\.", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", lpFilePart=0x0) returned 0x72 [0218.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ed54) returned 1 [0218.910] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", nBufferLength=0x105, lpBuffer=0x559e85c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", lpFilePart=0x0) returned 0x72 [0218.910] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\", nBufferLength=0x105, lpBuffer=0x559e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\", lpFilePart=0x0) returned 0x73 [0218.911] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\*", lpFindFileData=0x559ea7c | out: lpFindFileData=0x559ea7c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0x4b528e70, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x4b528e70, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x60b8ea8 [0218.911] FindClose (in: hFindFile=0x60b8ea8 | out: hFindFile=0x60b8ea8) returned 1 [0218.912] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\*", lpFindFileData=0x559ea8c | out: lpFindFileData=0x559ea8c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0x4b528e70, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x4b528e70, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x60b8ea8 [0218.912] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eaa0 | out: lpFindFileData=0x559eaa0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0x4b528e70, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x4b528e70, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.913] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eaa0 | out: lpFindFileData=0x559eaa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x484a8e30, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x484a8e30, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x484a8e30, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x4f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cookies.txt", cAlternateFileName="")) returned 1 [0218.913] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eaa0 | out: lpFindFileData=0x559eaa0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x46a9fd90, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x46a9fd90, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x46a9fd90, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBs", cAlternateFileName="")) returned 1 [0218.913] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eaa0 | out: lpFindFileData=0x559eaa0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42c49d70, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43dfe110, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43dfe110, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dirs", cAlternateFileName="")) returned 1 [0218.913] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eaa0 | out: lpFindFileData=0x559eaa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4b528e70, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x4b528e70, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x4be88510, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x712, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hardware & Soft.txt", cAlternateFileName="HARDWA~1.TXT")) returned 1 [0218.914] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eaa0 | out: lpFindFileData=0x559eaa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x48cfdb30, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x48cfdb30, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x48cfdb30, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Others.txt", cAlternateFileName="")) returned 1 [0218.914] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eaa0 | out: lpFindFileData=0x559eaa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42ed14d0, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x42ed14d0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x46eca410, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0xaac, dwReserved0=0x0, dwReserved1=0x0, cFileName="processes.txt", cAlternateFileName="PROCES~1.TXT")) returned 1 [0218.914] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eaa0 | out: lpFindFileData=0x559eaa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4568a3f0, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x4568a3f0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x467f24d0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x17d39, dwReserved0=0x0, dwReserved1=0x0, cFileName="screen.jpeg", cAlternateFileName="SCREEN~1.JPE")) returned 1 [0218.914] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eaa0 | out: lpFindFileData=0x559eaa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4568a3f0, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x4568a3f0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x467f24d0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x17d39, dwReserved0=0x0, dwReserved1=0x0, cFileName="screen.jpeg", cAlternateFileName="SCREEN~1.JPE")) returned 0 [0218.914] FindClose (in: hFindFile=0x60b8ea8 | out: hFindFile=0x60b8ea8) returned 1 [0218.914] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\*", lpFindFileData=0x559eacc | out: lpFindFileData=0x559eacc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0x4b528e70, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x4b528e70, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x60b8ea8 [0218.915] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eae0 | out: lpFindFileData=0x559eae0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0x4b528e70, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x4b528e70, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.915] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eae0 | out: lpFindFileData=0x559eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x484a8e30, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x484a8e30, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x484a8e30, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x4f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cookies.txt", cAlternateFileName="")) returned 1 [0218.915] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Cookies.txt", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Cookies.txt", lpFilePart=0x0) returned 0x7e [0218.915] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Cookies.txt", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Cookies.txt", lpFilePart=0x0) returned 0x7e [0218.915] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Cookies.txt", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Cookies.txt", lpFilePart=0x0) returned 0x7e [0218.916] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Cookies.txt", nBufferLength=0x105, lpBuffer=0x559e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Cookies.txt", lpFilePart=0x0) returned 0x7e [0218.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec44) returned 1 [0218.916] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Cookies.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\cookies.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x614 [0218.916] GetFileType (hFile=0x614) returned 0x1 [0218.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec40) returned 1 [0218.916] GetFileType (hFile=0x614) returned 0x1 [0218.917] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Cookies.txt", nBufferLength=0x105, lpBuffer=0x559e800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Cookies.txt", lpFilePart=0x0) returned 0x7e [0218.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec94) returned 1 [0218.917] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Cookies.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\cookies.txt"), fInfoLevelId=0x0, lpFileInformation=0x559ed10 | out: lpFileInformation=0x559ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x484a8e30, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x484a8e30, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x484a8e30, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x4f)) returned 1 [0218.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec90) returned 1 [0218.925] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x559df90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0218.926] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrcompression.dll", nBufferLength=0x105, lpBuffer=0x559e008, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrcompression.dll", lpFilePart=0x0) returned 0x40 [0218.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559e468) returned 1 [0218.926] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrcompression.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrcompression.dll"), fInfoLevelId=0x0, lpFileInformation=0x559e4e4 | out: lpFileInformation=0x559e4e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef914800, ftCreationTime.dwHighDateTime=0x1d0aa91, ftLastAccessTime.dwLowDateTime=0x587ebce0, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0xef914800, ftLastWriteTime.dwHighDateTime=0x1d0aa91, nFileSizeHigh=0x0, nFileSizeLow=0x1deb8)) returned 1 [0218.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559e464) returned 1 [0218.927] LoadLibraryW (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrcompression.dll") returned 0x6f070000 [0219.034] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="deflateInit2_", cchWideChar=13, lpMultiByteStr=0x559e4ac, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="deflateInit2_á´s\x0b9­\x1a\x94ÂOtÈæY\x05\x10åY\x05´\x83\x98s", lpUsedDefaultChar=0x0) returned 13 [0219.034] GetProcAddress (hModule=0x6f070000, lpProcName="deflateInit2_") returned 0x6f0798d1 [0219.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="deflate", cchWideChar=7, lpMultiByteStr=0x559e4b0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="deflate\x05@á´s\x0b9­\x1a\x94ÂOtÈæY\x05\x14µ¨t", lpUsedDefaultChar=0x0) returned 7 [0219.038] GetProcAddress (hModule=0x6f070000, lpProcName="deflate") returned 0x6f0790d5 [0219.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="deflateEnd", cchWideChar=10, lpMultiByteStr=0x559e4b0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="deflateEnd´s\x0b9­\x1a\x94ÂOtÈæY\x05\x14µ¨t", lpUsedDefaultChar=0x0) returned 10 [0219.040] GetProcAddress (hModule=0x6f070000, lpProcName="deflateEnd") returned 0x6f079828 [0219.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="inflateInit2_", cchWideChar=13, lpMultiByteStr=0x559e4ac, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="inflateInit2_á´s\x0b9­\x1a\x94ÂOtÈæY\x05\x14µ¨t", lpUsedDefaultChar=0x0) returned 13 [0219.040] GetProcAddress (hModule=0x6f070000, lpProcName="inflateInit2_") returned 0x6f07b7c3 [0219.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="inflate", cchWideChar=7, lpMultiByteStr=0x559e4b0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="inflate\x05@á´s\x0b9­\x1a\x94ÂOtÈæY\x05\x14µ¨t", lpUsedDefaultChar=0x0) returned 7 [0219.041] GetProcAddress (hModule=0x6f070000, lpProcName="inflate") returned 0x6f07a357 [0219.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="inflateEnd", cchWideChar=10, lpMultiByteStr=0x559e4b0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="inflateEnd´s\x0b9­\x1a\x94ÂOtÈæY\x05\x14µ¨t", lpUsedDefaultChar=0x0) returned 10 [0219.042] GetProcAddress (hModule=0x6f070000, lpProcName="inflateEnd") returned 0x6f07b783 [0219.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="zlibCompileFlags", cchWideChar=16, lpMultiByteStr=0x559e4a8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zlibCompileFlags@á´s\x0b9­\x1a\x94ÂOtÈæY\x05\x14µ¨t", lpUsedDefaultChar=0x0) returned 16 [0219.042] GetProcAddress (hModule=0x6f070000, lpProcName="zlibCompileFlags") returned 0x6f07d606 [0219.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1.2.3", cchWideChar=5, lpMultiByteStr=0x559eba8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1.2.3\x98ós\x0b9­\x1a\x94ÂOtàøY\x05", lpUsedDefaultChar=0x0) returned 5 [0219.048] ReadFile (in: hFile=0x614, lpBuffer=0x253bfa4, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x559ecb8, lpOverlapped=0x0 | out: lpBuffer=0x253bfa4*, lpNumberOfBytesRead=0x559ecb8*=0x4f, lpOverlapped=0x0) returned 1 [0219.050] ReadFile (in: hFile=0x614, lpBuffer=0x253bfa4, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x559ecb8, lpOverlapped=0x0 | out: lpBuffer=0x253bfa4*, lpNumberOfBytesRead=0x559ecb8*=0x0, lpOverlapped=0x0) returned 1 [0219.051] WriteFile (in: hFile=0x5ec, lpBuffer=0x2550050*, nNumberOfBytesToWrite=0x79, lpNumberOfBytesWritten=0x559ec48, lpOverlapped=0x0 | out: lpBuffer=0x2550050*, lpNumberOfBytesWritten=0x559ec48*=0x79, lpOverlapped=0x0) returned 1 [0219.052] SetFilePointer (in: hFile=0x5ec, lDistanceToMove=14, lpDistanceToMoveHigh=0x559ec5c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x559ec5c*=0) returned 0xe [0219.052] WriteFile (in: hFile=0x5ec, lpBuffer=0x2550050*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x559ec48, lpOverlapped=0x0 | out: lpBuffer=0x2550050*, lpNumberOfBytesWritten=0x559ec48*=0xc, lpOverlapped=0x0) returned 1 [0219.052] SetFilePointer (in: hFile=0x5ec, lDistanceToMove=121, lpDistanceToMoveHigh=0x559ec5c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x559ec5c*=0) returned 0x79 [0219.052] CloseHandle (hObject=0x614) returned 1 [0219.052] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eae0 | out: lpFindFileData=0x559eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x46a9fd90, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x46a9fd90, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x46a9fd90, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBs", cAlternateFileName="")) returned 1 [0219.053] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\.", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs", lpFilePart=0x0) returned 0x76 [0219.053] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\.", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs", lpFilePart=0x0) returned 0x76 [0219.053] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ed28) returned 1 [0219.053] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs", nBufferLength=0x105, lpBuffer=0x559e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs", lpFilePart=0x0) returned 0x76 [0219.053] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\", nBufferLength=0x105, lpBuffer=0x559e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\", lpFilePart=0x0) returned 0x77 [0219.053] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\*", lpFindFileData=0x559ea50 | out: lpFindFileData=0x559ea50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x46a9fd90, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x46a9fd90, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x46a9fd90, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x60b8fa8 [0219.053] FindClose (in: hFindFile=0x60b8fa8 | out: hFindFile=0x60b8fa8) returned 1 [0219.053] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\*", lpFindFileData=0x559ea60 | out: lpFindFileData=0x559ea60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x46a9fd90, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x46a9fd90, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x46a9fd90, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x60b8fa8 [0219.054] FindNextFileW (in: hFindFile=0x60b8fa8, lpFindFileData=0x559ea74 | out: lpFindFileData=0x559ea74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x46a9fd90, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x46a9fd90, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x46a9fd90, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.054] FindNextFileW (in: hFindFile=0x60b8fa8, lpFindFileData=0x559ea74 | out: lpFindFileData=0x559ea74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x46a9fd90, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x47791530, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x47791530, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google", cAlternateFileName="")) returned 1 [0219.054] FindNextFileW (in: hFindFile=0x60b8fa8, lpFindFileData=0x559ea74 | out: lpFindFileData=0x559ea74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x46a9fd90, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x47791530, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x47791530, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google", cAlternateFileName="")) returned 0 [0219.054] FindClose (in: hFindFile=0x60b8fa8 | out: hFindFile=0x60b8fa8) returned 1 [0219.055] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\*", lpFindFileData=0x559eaa0 | out: lpFindFileData=0x559eaa0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x46a9fd90, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x46a9fd90, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x46a9fd90, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x60b8fa8 [0219.055] FindNextFileW (in: hFindFile=0x60b8fa8, lpFindFileData=0x559eab4 | out: lpFindFileData=0x559eab4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x46a9fd90, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x46a9fd90, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x46a9fd90, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.055] FindNextFileW (in: hFindFile=0x60b8fa8, lpFindFileData=0x559eab4 | out: lpFindFileData=0x559eab4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x46a9fd90, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x47791530, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x47791530, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google", cAlternateFileName="")) returned 1 [0219.055] FindClose (in: hFindFile=0x60b8fa8 | out: hFindFile=0x60b8fa8) returned 1 [0219.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ed48) returned 1 [0219.055] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eae0 | out: lpFindFileData=0x559eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42c49d70, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43dfe110, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43dfe110, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dirs", cAlternateFileName="")) returned 1 [0219.055] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\.", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs", lpFilePart=0x0) returned 0x77 [0219.055] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\.", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs", lpFilePart=0x0) returned 0x77 [0219.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ed28) returned 1 [0219.056] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs", nBufferLength=0x105, lpBuffer=0x559e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs", lpFilePart=0x0) returned 0x77 [0219.056] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\", nBufferLength=0x105, lpBuffer=0x559e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\", lpFilePart=0x0) returned 0x78 [0219.056] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\*", lpFindFileData=0x559ea50 | out: lpFindFileData=0x559ea50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42c49d70, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43dfe110, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43dfe110, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x60b8fa8 [0219.056] FindClose (in: hFindFile=0x60b8fa8 | out: hFindFile=0x60b8fa8) returned 1 [0219.056] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\*", lpFindFileData=0x559ea60 | out: lpFindFileData=0x559ea60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42c49d70, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43dfe110, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43dfe110, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x60b8fa8 [0219.056] FindNextFileW (in: hFindFile=0x60b8fa8, lpFindFileData=0x559ea74 | out: lpFindFileData=0x559ea74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42c49d70, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43dfe110, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43dfe110, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.056] FindNextFileW (in: hFindFile=0x60b8fa8, lpFindFileData=0x559ea74 | out: lpFindFileData=0x559ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x433e0390, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x433e0390, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x434064f0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x3ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.txt", cAlternateFileName="")) returned 1 [0219.057] FindNextFileW (in: hFindFile=0x60b8fa8, lpFindFileData=0x559ea74 | out: lpFindFileData=0x559ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43ade430, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43ade430, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43ade430, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x559, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents.txt", cAlternateFileName="DOCUME~1.TXT")) returned 1 [0219.057] FindNextFileW (in: hFindFile=0x60b8fa8, lpFindFileData=0x559ea74 | out: lpFindFileData=0x559ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43cf3770, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43cf3770, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43cf3770, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads.txt", cAlternateFileName="DOWNLO~1.TXT")) returned 1 [0219.057] FindNextFileW (in: hFindFile=0x60b8fa8, lpFindFileData=0x559ea74 | out: lpFindFileData=0x559ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43b2a6f0, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43b2a6f0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43b2a6f0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x31f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures.txt", cAlternateFileName="")) returned 1 [0219.057] FindNextFileW (in: hFindFile=0x60b8fa8, lpFindFileData=0x559ea74 | out: lpFindFileData=0x559ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43cf3770, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43cf3770, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43cf3770, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Startup.txt", cAlternateFileName="")) returned 1 [0219.057] FindNextFileW (in: hFindFile=0x60b8fa8, lpFindFileData=0x559ea74 | out: lpFindFileData=0x559ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43dfe110, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43dfe110, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43dfe110, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x49f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp.txt", cAlternateFileName="")) returned 1 [0219.057] FindNextFileW (in: hFindFile=0x60b8fa8, lpFindFileData=0x559ea74 | out: lpFindFileData=0x559ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43ccd610, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43ccd610, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43ccd610, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos.txt", cAlternateFileName="")) returned 1 [0219.058] FindNextFileW (in: hFindFile=0x60b8fa8, lpFindFileData=0x559ea74 | out: lpFindFileData=0x559ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43ccd610, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43ccd610, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43ccd610, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos.txt", cAlternateFileName="")) returned 0 [0219.058] FindClose (in: hFindFile=0x60b8fa8 | out: hFindFile=0x60b8fa8) returned 1 [0219.058] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\*", lpFindFileData=0x559eaa0 | out: lpFindFileData=0x559eaa0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42c49d70, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43dfe110, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43dfe110, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x60b8fa8 [0219.058] FindNextFileW (in: hFindFile=0x60b8fa8, lpFindFileData=0x559eab4 | out: lpFindFileData=0x559eab4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42c49d70, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43dfe110, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43dfe110, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.058] FindNextFileW (in: hFindFile=0x60b8fa8, lpFindFileData=0x559eab4 | out: lpFindFileData=0x559eab4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x433e0390, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x433e0390, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x434064f0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x3ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.txt", cAlternateFileName="")) returned 1 [0219.058] FindClose (in: hFindFile=0x60b8fa8 | out: hFindFile=0x60b8fa8) returned 1 [0219.058] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ed48) returned 1 [0219.058] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eae0 | out: lpFindFileData=0x559eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4b528e70, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x4b528e70, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x4be88510, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x712, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hardware & Soft.txt", cAlternateFileName="HARDWA~1.TXT")) returned 1 [0219.059] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Hardware & Soft.txt", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Hardware & Soft.txt", lpFilePart=0x0) returned 0x86 [0219.059] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Hardware & Soft.txt", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Hardware & Soft.txt", lpFilePart=0x0) returned 0x86 [0219.059] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Hardware & Soft.txt", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Hardware & Soft.txt", lpFilePart=0x0) returned 0x86 [0219.059] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Hardware & Soft.txt", nBufferLength=0x105, lpBuffer=0x559e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Hardware & Soft.txt", lpFilePart=0x0) returned 0x86 [0219.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec44) returned 1 [0219.059] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Hardware & Soft.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\hardware & soft.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x614 [0219.059] GetFileType (hFile=0x614) returned 0x1 [0219.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec40) returned 1 [0219.059] GetFileType (hFile=0x614) returned 0x1 [0219.059] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Hardware & Soft.txt", nBufferLength=0x105, lpBuffer=0x559e800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Hardware & Soft.txt", lpFilePart=0x0) returned 0x86 [0219.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec94) returned 1 [0219.059] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Hardware & Soft.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\hardware & soft.txt"), fInfoLevelId=0x0, lpFileInformation=0x559ed10 | out: lpFileInformation=0x559ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4b528e70, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x4b528e70, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x4be88510, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x712)) returned 1 [0219.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec90) returned 1 [0219.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1.2.3", cchWideChar=5, lpMultiByteStr=0x559eba8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1.2.3\x98ós\x0b9­\x1a\x94ÂOtàøY\x05X\x94Othf¸s", lpUsedDefaultChar=0x0) returned 5 [0219.060] ReadFile (in: hFile=0x614, lpBuffer=0x25590a0, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x559ecb8, lpOverlapped=0x0 | out: lpBuffer=0x25590a0*, lpNumberOfBytesRead=0x559ecb8*=0x712, lpOverlapped=0x0) returned 1 [0219.060] ReadFile (in: hFile=0x614, lpBuffer=0x25590a0, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x559ecb8, lpOverlapped=0x0 | out: lpBuffer=0x25590a0*, lpNumberOfBytesRead=0x559ecb8*=0x0, lpOverlapped=0x0) returned 1 [0219.060] WriteFile (in: hFile=0x5ec, lpBuffer=0x2550050*, nNumberOfBytesToWrite=0x301, lpNumberOfBytesWritten=0x559ec48, lpOverlapped=0x0 | out: lpBuffer=0x2550050*, lpNumberOfBytesWritten=0x559ec48*=0x301, lpOverlapped=0x0) returned 1 [0219.061] SetFilePointer (in: hFile=0x5ec, lDistanceToMove=135, lpDistanceToMoveHigh=0x559ec5c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x559ec5c*=0) returned 0x87 [0219.061] WriteFile (in: hFile=0x5ec, lpBuffer=0x2550050*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x559ec48, lpOverlapped=0x0 | out: lpBuffer=0x2550050*, lpNumberOfBytesWritten=0x559ec48*=0xc, lpOverlapped=0x0) returned 1 [0219.061] SetFilePointer (in: hFile=0x5ec, lDistanceToMove=890, lpDistanceToMoveHigh=0x559ec5c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x559ec5c*=0) returned 0x37a [0219.061] CloseHandle (hObject=0x614) returned 1 [0219.061] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eae0 | out: lpFindFileData=0x559eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x48cfdb30, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x48cfdb30, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x48cfdb30, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Others.txt", cAlternateFileName="")) returned 1 [0219.061] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Others.txt", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Others.txt", lpFilePart=0x0) returned 0x7d [0219.061] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Others.txt", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Others.txt", lpFilePart=0x0) returned 0x7d [0219.061] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Others.txt", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Others.txt", lpFilePart=0x0) returned 0x7d [0219.061] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Others.txt", nBufferLength=0x105, lpBuffer=0x559e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Others.txt", lpFilePart=0x0) returned 0x7d [0219.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec44) returned 1 [0219.062] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Others.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\others.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x614 [0219.062] GetFileType (hFile=0x614) returned 0x1 [0219.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec40) returned 1 [0219.062] GetFileType (hFile=0x614) returned 0x1 [0219.062] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Others.txt", nBufferLength=0x105, lpBuffer=0x559e800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Others.txt", lpFilePart=0x0) returned 0x7d [0219.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec94) returned 1 [0219.062] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Others.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\others.txt"), fInfoLevelId=0x0, lpFileInformation=0x559ed10 | out: lpFileInformation=0x559ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x48cfdb30, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x48cfdb30, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x48cfdb30, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x8c)) returned 1 [0219.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec90) returned 1 [0219.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1.2.3", cchWideChar=5, lpMultiByteStr=0x559eba8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1.2.3\x98ós\x0b9­\x1a\x94ÂOtàøY\x05X\x94Othf¸s", lpUsedDefaultChar=0x0) returned 5 [0219.063] ReadFile (in: hFile=0x614, lpBuffer=0x25701f0, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x559ecb8, lpOverlapped=0x0 | out: lpBuffer=0x25701f0*, lpNumberOfBytesRead=0x559ecb8*=0x8c, lpOverlapped=0x0) returned 1 [0219.063] ReadFile (in: hFile=0x614, lpBuffer=0x25701f0, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x559ecb8, lpOverlapped=0x0 | out: lpBuffer=0x25701f0*, lpNumberOfBytesRead=0x559ecb8*=0x0, lpOverlapped=0x0) returned 1 [0219.064] WriteFile (in: hFile=0x5ec, lpBuffer=0x2550050*, nNumberOfBytesToWrite=0x9a, lpNumberOfBytesWritten=0x559ec48, lpOverlapped=0x0 | out: lpBuffer=0x2550050*, lpNumberOfBytesWritten=0x559ec48*=0x9a, lpOverlapped=0x0) returned 1 [0219.064] SetFilePointer (in: hFile=0x5ec, lDistanceToMove=904, lpDistanceToMoveHigh=0x559ec5c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x559ec5c*=0) returned 0x388 [0219.064] WriteFile (in: hFile=0x5ec, lpBuffer=0x2550050*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x559ec48, lpOverlapped=0x0 | out: lpBuffer=0x2550050*, lpNumberOfBytesWritten=0x559ec48*=0xc, lpOverlapped=0x0) returned 1 [0219.064] SetFilePointer (in: hFile=0x5ec, lDistanceToMove=1044, lpDistanceToMoveHigh=0x559ec5c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x559ec5c*=0) returned 0x414 [0219.064] CloseHandle (hObject=0x614) returned 1 [0219.064] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eae0 | out: lpFindFileData=0x559eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42ed14d0, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x42ed14d0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x46eca410, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0xaac, dwReserved0=0x0, dwReserved1=0x0, cFileName="processes.txt", cAlternateFileName="PROCES~1.TXT")) returned 1 [0219.064] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\processes.txt", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\processes.txt", lpFilePart=0x0) returned 0x80 [0219.064] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\processes.txt", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\processes.txt", lpFilePart=0x0) returned 0x80 [0219.065] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\processes.txt", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\processes.txt", lpFilePart=0x0) returned 0x80 [0219.065] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\processes.txt", nBufferLength=0x105, lpBuffer=0x559e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\processes.txt", lpFilePart=0x0) returned 0x80 [0219.065] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec44) returned 1 [0219.065] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\processes.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\processes.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x614 [0219.065] GetFileType (hFile=0x614) returned 0x1 [0219.065] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec40) returned 1 [0219.065] GetFileType (hFile=0x614) returned 0x1 [0219.065] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\processes.txt", nBufferLength=0x105, lpBuffer=0x559e800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\processes.txt", lpFilePart=0x0) returned 0x80 [0219.065] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec94) returned 1 [0219.065] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\processes.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\processes.txt"), fInfoLevelId=0x0, lpFileInformation=0x559ed10 | out: lpFileInformation=0x559ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42ed14d0, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x42ed14d0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x46eca410, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0xaac)) returned 1 [0219.065] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec90) returned 1 [0219.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1.2.3", cchWideChar=5, lpMultiByteStr=0x559eba8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1.2.3\x98ós\x0b9­\x1a\x94ÂOtàøY\x05X\x94Othf¸s", lpUsedDefaultChar=0x0) returned 5 [0219.066] ReadFile (in: hFile=0x614, lpBuffer=0x2587460, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x559ecb8, lpOverlapped=0x0 | out: lpBuffer=0x2587460*, lpNumberOfBytesRead=0x559ecb8*=0xaac, lpOverlapped=0x0) returned 1 [0219.067] ReadFile (in: hFile=0x614, lpBuffer=0x2587460, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x559ecb8, lpOverlapped=0x0 | out: lpBuffer=0x2587460*, lpNumberOfBytesRead=0x559ecb8*=0x0, lpOverlapped=0x0) returned 1 [0219.067] WriteFile (in: hFile=0x5ec, lpBuffer=0x2550050*, nNumberOfBytesToWrite=0x233, lpNumberOfBytesWritten=0x559ec48, lpOverlapped=0x0 | out: lpBuffer=0x2550050*, lpNumberOfBytesWritten=0x559ec48*=0x233, lpOverlapped=0x0) returned 1 [0219.067] SetFilePointer (in: hFile=0x5ec, lDistanceToMove=1058, lpDistanceToMoveHigh=0x559ec5c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x559ec5c*=0) returned 0x422 [0219.067] WriteFile (in: hFile=0x5ec, lpBuffer=0x2550050*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x559ec48, lpOverlapped=0x0 | out: lpBuffer=0x2550050*, lpNumberOfBytesWritten=0x559ec48*=0xc, lpOverlapped=0x0) returned 1 [0219.067] SetFilePointer (in: hFile=0x5ec, lDistanceToMove=1607, lpDistanceToMoveHigh=0x559ec5c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x559ec5c*=0) returned 0x647 [0219.067] CloseHandle (hObject=0x614) returned 1 [0219.067] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eae0 | out: lpFindFileData=0x559eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4568a3f0, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x4568a3f0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x467f24d0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x17d39, dwReserved0=0x0, dwReserved1=0x0, cFileName="screen.jpeg", cAlternateFileName="SCREEN~1.JPE")) returned 1 [0219.068] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\screen.jpeg", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\screen.jpeg", lpFilePart=0x0) returned 0x7e [0219.068] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\screen.jpeg", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\screen.jpeg", lpFilePart=0x0) returned 0x7e [0219.068] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\screen.jpeg", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\screen.jpeg", lpFilePart=0x0) returned 0x7e [0219.068] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\screen.jpeg", nBufferLength=0x105, lpBuffer=0x559e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\screen.jpeg", lpFilePart=0x0) returned 0x7e [0219.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec44) returned 1 [0219.068] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\screen.jpeg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\screen.jpeg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x614 [0219.068] GetFileType (hFile=0x614) returned 0x1 [0219.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec40) returned 1 [0219.068] GetFileType (hFile=0x614) returned 0x1 [0219.068] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\screen.jpeg", nBufferLength=0x105, lpBuffer=0x559e800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\screen.jpeg", lpFilePart=0x0) returned 0x7e [0219.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec94) returned 1 [0219.068] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\screen.jpeg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\screen.jpeg"), fInfoLevelId=0x0, lpFileInformation=0x559ed10 | out: lpFileInformation=0x559ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4568a3f0, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x4568a3f0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x467f24d0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x17d39)) returned 1 [0219.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec90) returned 1 [0219.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1.2.3", cchWideChar=5, lpMultiByteStr=0x559eba8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1.2.3\x98ós\x0b9­\x1a\x94ÂOtàøY\x05X\x94Othf¸s", lpUsedDefaultChar=0x0) returned 5 [0219.069] ReadFile (in: hFile=0x614, lpBuffer=0x259e624, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x559ecb8, lpOverlapped=0x0 | out: lpBuffer=0x259e624*, lpNumberOfBytesRead=0x559ecb8*=0x14000, lpOverlapped=0x0) returned 1 [0219.072] WriteFile (in: hFile=0x5ec, lpBuffer=0x2550050*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x559ec20, lpOverlapped=0x0 | out: lpBuffer=0x2550050*, lpNumberOfBytesWritten=0x559ec20*=0x1000, lpOverlapped=0x0) returned 1 [0219.073] WriteFile (in: hFile=0x5ec, lpBuffer=0x259d52b*, nNumberOfBytesToWrite=0x1029, lpNumberOfBytesWritten=0x559ec20, lpOverlapped=0x0 | out: lpBuffer=0x259d52b*, lpNumberOfBytesWritten=0x559ec20*=0x1029, lpOverlapped=0x0) returned 1 [0219.073] WriteFile (in: hFile=0x5ec, lpBuffer=0x259c554*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x559ec20, lpOverlapped=0x0 | out: lpBuffer=0x259c554*, lpNumberOfBytesWritten=0x559ec20*=0x2000, lpOverlapped=0x0) returned 1 [0219.074] WriteFile (in: hFile=0x5ec, lpBuffer=0x259c554*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x559ec20, lpOverlapped=0x0 | out: lpBuffer=0x259c554*, lpNumberOfBytesWritten=0x559ec20*=0x2000, lpOverlapped=0x0) returned 1 [0219.074] WriteFile (in: hFile=0x5ec, lpBuffer=0x259c554*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x559ec20, lpOverlapped=0x0 | out: lpBuffer=0x259c554*, lpNumberOfBytesWritten=0x559ec20*=0x2000, lpOverlapped=0x0) returned 1 [0219.075] WriteFile (in: hFile=0x5ec, lpBuffer=0x259c554*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x559ec20, lpOverlapped=0x0 | out: lpBuffer=0x259c554*, lpNumberOfBytesWritten=0x559ec20*=0x2000, lpOverlapped=0x0) returned 1 [0219.076] WriteFile (in: hFile=0x5ec, lpBuffer=0x259c554*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x559ec20, lpOverlapped=0x0 | out: lpBuffer=0x259c554*, lpNumberOfBytesWritten=0x559ec20*=0x2000, lpOverlapped=0x0) returned 1 [0219.077] WriteFile (in: hFile=0x5ec, lpBuffer=0x259c554*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x559ec20, lpOverlapped=0x0 | out: lpBuffer=0x259c554*, lpNumberOfBytesWritten=0x559ec20*=0x2000, lpOverlapped=0x0) returned 1 [0219.077] ReadFile (in: hFile=0x614, lpBuffer=0x259e624, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x559ecb8, lpOverlapped=0x0 | out: lpBuffer=0x259e624*, lpNumberOfBytesRead=0x559ecb8*=0x3d39, lpOverlapped=0x0) returned 1 [0219.077] WriteFile (in: hFile=0x5ec, lpBuffer=0x259c554*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x559ec20, lpOverlapped=0x0 | out: lpBuffer=0x259c554*, lpNumberOfBytesWritten=0x559ec20*=0x2000, lpOverlapped=0x0) returned 1 [0219.078] WriteFile (in: hFile=0x5ec, lpBuffer=0x259c554*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x559ec20, lpOverlapped=0x0 | out: lpBuffer=0x259c554*, lpNumberOfBytesWritten=0x559ec20*=0x2000, lpOverlapped=0x0) returned 1 [0219.079] ReadFile (in: hFile=0x614, lpBuffer=0x259e624, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x559ecb8, lpOverlapped=0x0 | out: lpBuffer=0x259e624*, lpNumberOfBytesRead=0x559ecb8*=0x0, lpOverlapped=0x0) returned 1 [0219.079] WriteFile (in: hFile=0x5ec, lpBuffer=0x259c554*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x559ec2c, lpOverlapped=0x0 | out: lpBuffer=0x259c554*, lpNumberOfBytesWritten=0x559ec2c*=0x2000, lpOverlapped=0x0) returned 1 [0219.079] WriteFile (in: hFile=0x5ec, lpBuffer=0x259c554*, nNumberOfBytesToWrite=0x1ec0, lpNumberOfBytesWritten=0x559ec2c, lpOverlapped=0x0 | out: lpBuffer=0x259c554*, lpNumberOfBytesWritten=0x559ec2c*=0x1ec0, lpOverlapped=0x0) returned 1 [0219.080] SetFilePointer (in: hFile=0x5ec, lDistanceToMove=1621, lpDistanceToMoveHigh=0x559ec5c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x559ec5c*=0) returned 0x655 [0219.080] WriteFile (in: hFile=0x5ec, lpBuffer=0x2550050*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x559ec48, lpOverlapped=0x0 | out: lpBuffer=0x2550050*, lpNumberOfBytesWritten=0x559ec48*=0xc, lpOverlapped=0x0) returned 1 [0219.080] SetFilePointer (in: hFile=0x5ec, lDistanceToMove=91440, lpDistanceToMoveHigh=0x559ec5c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x559ec5c*=0) returned 0x16530 [0219.080] CloseHandle (hObject=0x614) returned 1 [0219.080] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eae0 | out: lpFindFileData=0x559eae0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0219.080] FindClose (in: hFindFile=0x60b8ea8 | out: hFindFile=0x60b8ea8) returned 1 [0219.080] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\*", lpFindFileData=0x559ea8c | out: lpFindFileData=0x559ea8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x46a9fd90, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x46a9fd90, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x46a9fd90, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x60b8ea8 [0219.080] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eaa0 | out: lpFindFileData=0x559eaa0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x46a9fd90, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x46a9fd90, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x46a9fd90, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.081] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eaa0 | out: lpFindFileData=0x559eaa0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x46a9fd90, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x47791530, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x47791530, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google", cAlternateFileName="")) returned 1 [0219.081] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eaa0 | out: lpFindFileData=0x559eaa0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x46a9fd90, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x47791530, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x47791530, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google", cAlternateFileName="")) returned 0 [0219.081] FindClose (in: hFindFile=0x60b8ea8 | out: hFindFile=0x60b8ea8) returned 1 [0219.081] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\*", lpFindFileData=0x559eacc | out: lpFindFileData=0x559eacc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x46a9fd90, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x46a9fd90, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x46a9fd90, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x60b8ea8 [0219.081] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eae0 | out: lpFindFileData=0x559eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x46a9fd90, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x46a9fd90, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x46a9fd90, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.081] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eae0 | out: lpFindFileData=0x559eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x46a9fd90, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x47791530, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x47791530, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google", cAlternateFileName="")) returned 1 [0219.082] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\.", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google", lpFilePart=0x0) returned 0x7d [0219.082] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\.", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google", lpFilePart=0x0) returned 0x7d [0219.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ed28) returned 1 [0219.082] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google", nBufferLength=0x105, lpBuffer=0x559e830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google", lpFilePart=0x0) returned 0x7d [0219.082] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\", nBufferLength=0x105, lpBuffer=0x559e804, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\", lpFilePart=0x0) returned 0x7e [0219.082] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\*", lpFindFileData=0x559ea50 | out: lpFindFileData=0x559ea50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x46a9fd90, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x47791530, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x47791530, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x60b8fa8 [0219.082] FindClose (in: hFindFile=0x60b8fa8 | out: hFindFile=0x60b8fa8) returned 1 [0219.082] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\*", lpFindFileData=0x559ea60 | out: lpFindFileData=0x559ea60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x46a9fd90, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x47791530, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x47791530, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x60b8fa8 [0219.082] FindNextFileW (in: hFindFile=0x60b8fa8, lpFindFileData=0x559ea74 | out: lpFindFileData=0x559ea74*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x46a9fd90, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x47791530, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x47791530, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.083] FindNextFileW (in: hFindFile=0x60b8fa8, lpFindFileData=0x559ea74 | out: lpFindFileData=0x559ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x47660a30, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x47660a30, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x98d1e730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0219.083] FindNextFileW (in: hFindFile=0x60b8fa8, lpFindFileData=0x559ea74 | out: lpFindFileData=0x559ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x47791530, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x47791530, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x9c0bf3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1082a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local State", cAlternateFileName="LOCALS~1")) returned 1 [0219.083] FindNextFileW (in: hFindFile=0x60b8fa8, lpFindFileData=0x559ea74 | out: lpFindFileData=0x559ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46a9fd90, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x46a9fd90, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x8124f5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Login Data", cAlternateFileName="LOGIND~1")) returned 1 [0219.083] FindNextFileW (in: hFindFile=0x60b8fa8, lpFindFileData=0x559ea74 | out: lpFindFileData=0x559ea74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46a9fd90, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x46a9fd90, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x8124f5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Login Data", cAlternateFileName="LOGIND~1")) returned 0 [0219.083] FindClose (in: hFindFile=0x60b8fa8 | out: hFindFile=0x60b8fa8) returned 1 [0219.083] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\*", lpFindFileData=0x559eaa0 | out: lpFindFileData=0x559eaa0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x46a9fd90, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x47791530, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x47791530, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x60b8fa8 [0219.084] FindNextFileW (in: hFindFile=0x60b8fa8, lpFindFileData=0x559eab4 | out: lpFindFileData=0x559eab4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x46a9fd90, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x47791530, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x47791530, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.084] FindNextFileW (in: hFindFile=0x60b8fa8, lpFindFileData=0x559eab4 | out: lpFindFileData=0x559eab4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x47660a30, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x47660a30, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x98d1e730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0219.084] FindClose (in: hFindFile=0x60b8fa8 | out: hFindFile=0x60b8fa8) returned 1 [0219.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ed48) returned 1 [0219.084] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eae0 | out: lpFindFileData=0x559eae0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0219.084] FindClose (in: hFindFile=0x60b8ea8 | out: hFindFile=0x60b8ea8) returned 1 [0219.084] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\*", lpFindFileData=0x559ea8c | out: lpFindFileData=0x559ea8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x46a9fd90, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x47791530, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x47791530, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x60b8ea8 [0219.084] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eaa0 | out: lpFindFileData=0x559eaa0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x46a9fd90, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x47791530, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x47791530, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.085] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eaa0 | out: lpFindFileData=0x559eaa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x47660a30, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x47660a30, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x98d1e730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0219.085] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eaa0 | out: lpFindFileData=0x559eaa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x47791530, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x47791530, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x9c0bf3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1082a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local State", cAlternateFileName="LOCALS~1")) returned 1 [0219.085] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eaa0 | out: lpFindFileData=0x559eaa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46a9fd90, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x46a9fd90, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x8124f5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Login Data", cAlternateFileName="LOGIND~1")) returned 1 [0219.086] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eaa0 | out: lpFindFileData=0x559eaa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46a9fd90, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x46a9fd90, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x8124f5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Login Data", cAlternateFileName="LOGIND~1")) returned 0 [0219.086] FindClose (in: hFindFile=0x60b8ea8 | out: hFindFile=0x60b8ea8) returned 1 [0219.086] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\*", lpFindFileData=0x559eacc | out: lpFindFileData=0x559eacc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x46a9fd90, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x47791530, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x47791530, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x60b8ea8 [0219.086] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eae0 | out: lpFindFileData=0x559eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x46a9fd90, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x47791530, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x47791530, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.086] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eae0 | out: lpFindFileData=0x559eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x47660a30, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x47660a30, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x98d1e730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0219.086] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Cookies", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Cookies", lpFilePart=0x0) returned 0x85 [0219.086] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Cookies", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Cookies", lpFilePart=0x0) returned 0x85 [0219.087] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Cookies", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Cookies", lpFilePart=0x0) returned 0x85 [0219.087] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Cookies", nBufferLength=0x105, lpBuffer=0x559e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Cookies", lpFilePart=0x0) returned 0x85 [0219.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec44) returned 1 [0219.087] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dbs\\google\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x614 [0219.087] GetFileType (hFile=0x614) returned 0x1 [0219.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec40) returned 1 [0219.087] GetFileType (hFile=0x614) returned 0x1 [0219.087] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Cookies", nBufferLength=0x105, lpBuffer=0x559e800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Cookies", lpFilePart=0x0) returned 0x85 [0219.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec94) returned 1 [0219.087] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dbs\\google\\cookies"), fInfoLevelId=0x0, lpFileInformation=0x559ed10 | out: lpFileInformation=0x559ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x47660a30, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x47660a30, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x98d1e730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c00)) returned 1 [0219.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec90) returned 1 [0219.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1.2.3", cchWideChar=5, lpMultiByteStr=0x559eba8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1.2.3\x98ós\x0b9­\x1a\x94ÂOtàøY\x05X\x94Othf¸s", lpUsedDefaultChar=0x0) returned 5 [0219.088] ReadFile (in: hFile=0x614, lpBuffer=0x25b9200, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x559ecb8, lpOverlapped=0x0 | out: lpBuffer=0x25b9200*, lpNumberOfBytesRead=0x559ecb8*=0x1c00, lpOverlapped=0x0) returned 1 [0219.089] ReadFile (in: hFile=0x614, lpBuffer=0x25b9200, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x559ecb8, lpOverlapped=0x0 | out: lpBuffer=0x25b9200*, lpNumberOfBytesRead=0x559ecb8*=0x0, lpOverlapped=0x0) returned 1 [0219.089] WriteFile (in: hFile=0x5ec, lpBuffer=0x2550050*, nNumberOfBytesToWrite=0x42a, lpNumberOfBytesWritten=0x559ec48, lpOverlapped=0x0 | out: lpBuffer=0x2550050*, lpNumberOfBytesWritten=0x559ec48*=0x42a, lpOverlapped=0x0) returned 1 [0219.089] SetFilePointer (in: hFile=0x5ec, lDistanceToMove=91454, lpDistanceToMoveHigh=0x559ec5c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x559ec5c*=0) returned 0x1653e [0219.089] WriteFile (in: hFile=0x5ec, lpBuffer=0x2550050*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x559ec48, lpOverlapped=0x0 | out: lpBuffer=0x2550050*, lpNumberOfBytesWritten=0x559ec48*=0xc, lpOverlapped=0x0) returned 1 [0219.089] SetFilePointer (in: hFile=0x5ec, lDistanceToMove=92506, lpDistanceToMoveHigh=0x559ec5c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x559ec5c*=0) returned 0x1695a [0219.089] CloseHandle (hObject=0x614) returned 1 [0219.090] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eae0 | out: lpFindFileData=0x559eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x47791530, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x47791530, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x9c0bf3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1082a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local State", cAlternateFileName="LOCALS~1")) returned 1 [0219.090] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Local State", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Local State", lpFilePart=0x0) returned 0x89 [0219.090] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Local State", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Local State", lpFilePart=0x0) returned 0x89 [0219.090] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Local State", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Local State", lpFilePart=0x0) returned 0x89 [0219.090] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Local State", nBufferLength=0x105, lpBuffer=0x559e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Local State", lpFilePart=0x0) returned 0x89 [0219.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec44) returned 1 [0219.090] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Local State" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dbs\\google\\local state"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x614 [0219.090] GetFileType (hFile=0x614) returned 0x1 [0219.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec40) returned 1 [0219.090] GetFileType (hFile=0x614) returned 0x1 [0219.090] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Local State", nBufferLength=0x105, lpBuffer=0x559e800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Local State", lpFilePart=0x0) returned 0x89 [0219.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec94) returned 1 [0219.090] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Local State" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dbs\\google\\local state"), fInfoLevelId=0x0, lpFileInformation=0x559ed10 | out: lpFileInformation=0x559ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x47791530, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x47791530, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x9c0bf3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1082a)) returned 1 [0219.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec90) returned 1 [0219.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1.2.3", cchWideChar=5, lpMultiByteStr=0x559eba8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1.2.3\x98ós\x0b9­\x1a\x94ÂOtàøY\x05X\x94Othf¸s", lpUsedDefaultChar=0x0) returned 5 [0219.091] ReadFile (in: hFile=0x614, lpBuffer=0x25d0478, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x559ecb8, lpOverlapped=0x0 | out: lpBuffer=0x25d0478*, lpNumberOfBytesRead=0x559ecb8*=0x1082a, lpOverlapped=0x0) returned 1 [0219.093] WriteFile (in: hFile=0x5ec, lpBuffer=0x2550050*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x559ec20, lpOverlapped=0x0 | out: lpBuffer=0x2550050*, lpNumberOfBytesWritten=0x559ec20*=0x1000, lpOverlapped=0x0) returned 1 [0219.093] WriteFile (in: hFile=0x5ec, lpBuffer=0x25cf374*, nNumberOfBytesToWrite=0x1034, lpNumberOfBytesWritten=0x559ec20, lpOverlapped=0x0 | out: lpBuffer=0x25cf374*, lpNumberOfBytesWritten=0x559ec20*=0x1034, lpOverlapped=0x0) returned 1 [0219.094] WriteFile (in: hFile=0x5ec, lpBuffer=0x25ce3a8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x559ec20, lpOverlapped=0x0 | out: lpBuffer=0x25ce3a8*, lpNumberOfBytesWritten=0x559ec20*=0x2000, lpOverlapped=0x0) returned 1 [0219.094] WriteFile (in: hFile=0x5ec, lpBuffer=0x25ce3a8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x559ec20, lpOverlapped=0x0 | out: lpBuffer=0x25ce3a8*, lpNumberOfBytesWritten=0x559ec20*=0x2000, lpOverlapped=0x0) returned 1 [0219.096] WriteFile (in: hFile=0x5ec, lpBuffer=0x25ce3a8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x559ec20, lpOverlapped=0x0 | out: lpBuffer=0x25ce3a8*, lpNumberOfBytesWritten=0x559ec20*=0x2000, lpOverlapped=0x0) returned 1 [0219.097] WriteFile (in: hFile=0x5ec, lpBuffer=0x25ce3a8*, nNumberOfBytesToWrite=0x18de, lpNumberOfBytesWritten=0x559ec20, lpOverlapped=0x0 | out: lpBuffer=0x25ce3a8*, lpNumberOfBytesWritten=0x559ec20*=0x18de, lpOverlapped=0x0) returned 1 [0219.097] ReadFile (in: hFile=0x614, lpBuffer=0x25d0478, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x559ecb8, lpOverlapped=0x0 | out: lpBuffer=0x25d0478*, lpNumberOfBytesRead=0x559ecb8*=0x0, lpOverlapped=0x0) returned 1 [0219.097] WriteFile (in: hFile=0x5ec, lpBuffer=0x25ce3a8*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x559ec2c, lpOverlapped=0x0 | out: lpBuffer=0x25ce3a8*, lpNumberOfBytesWritten=0x559ec2c*=0x2000, lpOverlapped=0x0) returned 1 [0219.097] WriteFile (in: hFile=0x5ec, lpBuffer=0x2550050*, nNumberOfBytesToWrite=0xafe, lpNumberOfBytesWritten=0x559ec48, lpOverlapped=0x0 | out: lpBuffer=0x2550050*, lpNumberOfBytesWritten=0x559ec48*=0xafe, lpOverlapped=0x0) returned 1 [0219.098] SetFilePointer (in: hFile=0x5ec, lDistanceToMove=92520, lpDistanceToMoveHigh=0x559ec5c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x559ec5c*=0) returned 0x16968 [0219.098] WriteFile (in: hFile=0x5ec, lpBuffer=0x2550050*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x559ec48, lpOverlapped=0x0 | out: lpBuffer=0x2550050*, lpNumberOfBytesWritten=0x559ec48*=0xc, lpOverlapped=0x0) returned 1 [0219.098] SetFilePointer (in: hFile=0x5ec, lDistanceToMove=142698, lpDistanceToMoveHigh=0x559ec5c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x559ec5c*=0) returned 0x22d6a [0219.098] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eae0 | out: lpFindFileData=0x559eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46a9fd90, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x46a9fd90, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x8124f5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Login Data", cAlternateFileName="LOGIND~1")) returned 1 [0219.098] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Login Data", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Login Data", lpFilePart=0x0) returned 0x88 [0219.098] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Login Data", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Login Data", lpFilePart=0x0) returned 0x88 [0219.099] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Login Data", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Login Data", lpFilePart=0x0) returned 0x88 [0219.099] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Login Data", nBufferLength=0x105, lpBuffer=0x559e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Login Data", lpFilePart=0x0) returned 0x88 [0219.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec44) returned 1 [0219.099] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Login Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dbs\\google\\login data"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x614 [0219.099] GetFileType (hFile=0x614) returned 0x1 [0219.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec40) returned 1 [0219.099] GetFileType (hFile=0x614) returned 0x1 [0219.099] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Login Data", nBufferLength=0x105, lpBuffer=0x559e800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Login Data", lpFilePart=0x0) returned 0x88 [0219.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec94) returned 1 [0219.099] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Login Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dbs\\google\\login data"), fInfoLevelId=0x0, lpFileInformation=0x559ed10 | out: lpFileInformation=0x559ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46a9fd90, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x46a9fd90, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x8124f5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4800)) returned 1 [0219.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec90) returned 1 [0219.100] ReadFile (in: hFile=0x614, lpBuffer=0x25e7858, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x559ecb8, lpOverlapped=0x0 | out: lpBuffer=0x25e7858*, lpNumberOfBytesRead=0x559ecb8*=0x4800, lpOverlapped=0x0) returned 1 [0219.101] ReadFile (in: hFile=0x614, lpBuffer=0x25e7858, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x559ecb8, lpOverlapped=0x0 | out: lpBuffer=0x25e7858*, lpNumberOfBytesRead=0x559ecb8*=0x0, lpOverlapped=0x0) returned 1 [0219.101] WriteFile (in: hFile=0x5ec, lpBuffer=0x2550050*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x559ec48, lpOverlapped=0x0 | out: lpBuffer=0x2550050*, lpNumberOfBytesWritten=0x559ec48*=0xc, lpOverlapped=0x0) returned 1 [0219.102] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eae0 | out: lpFindFileData=0x559eae0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0219.102] FindClose (in: hFindFile=0x60b8ea8 | out: hFindFile=0x60b8ea8) returned 1 [0219.102] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\*", lpFindFileData=0x559ea8c | out: lpFindFileData=0x559ea8c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42c49d70, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43dfe110, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43dfe110, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x60b8ea8 [0219.102] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eaa0 | out: lpFindFileData=0x559eaa0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42c49d70, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43dfe110, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43dfe110, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.102] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eaa0 | out: lpFindFileData=0x559eaa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x433e0390, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x433e0390, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x434064f0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x3ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.txt", cAlternateFileName="")) returned 1 [0219.102] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eaa0 | out: lpFindFileData=0x559eaa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43ade430, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43ade430, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43ade430, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x559, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents.txt", cAlternateFileName="DOCUME~1.TXT")) returned 1 [0219.103] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eaa0 | out: lpFindFileData=0x559eaa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43cf3770, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43cf3770, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43cf3770, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads.txt", cAlternateFileName="DOWNLO~1.TXT")) returned 1 [0219.103] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eaa0 | out: lpFindFileData=0x559eaa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43b2a6f0, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43b2a6f0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43b2a6f0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x31f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures.txt", cAlternateFileName="")) returned 1 [0219.103] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eaa0 | out: lpFindFileData=0x559eaa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43cf3770, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43cf3770, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43cf3770, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Startup.txt", cAlternateFileName="")) returned 1 [0219.103] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eaa0 | out: lpFindFileData=0x559eaa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43dfe110, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43dfe110, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43dfe110, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x49f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp.txt", cAlternateFileName="")) returned 1 [0219.103] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eaa0 | out: lpFindFileData=0x559eaa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43ccd610, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43ccd610, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43ccd610, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos.txt", cAlternateFileName="")) returned 1 [0219.103] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eaa0 | out: lpFindFileData=0x559eaa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43ccd610, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43ccd610, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43ccd610, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos.txt", cAlternateFileName="")) returned 0 [0219.104] FindClose (in: hFindFile=0x60b8ea8 | out: hFindFile=0x60b8ea8) returned 1 [0219.104] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\*", lpFindFileData=0x559eacc | out: lpFindFileData=0x559eacc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42c49d70, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43dfe110, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43dfe110, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x60b8ea8 [0219.104] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eae0 | out: lpFindFileData=0x559eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42c49d70, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43dfe110, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43dfe110, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.104] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eae0 | out: lpFindFileData=0x559eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x433e0390, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x433e0390, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x434064f0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x3ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.txt", cAlternateFileName="")) returned 1 [0219.104] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Desktop.txt", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Desktop.txt", lpFilePart=0x0) returned 0x83 [0219.104] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Desktop.txt", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Desktop.txt", lpFilePart=0x0) returned 0x83 [0219.104] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Desktop.txt", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Desktop.txt", lpFilePart=0x0) returned 0x83 [0219.104] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Desktop.txt", nBufferLength=0x105, lpBuffer=0x559e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Desktop.txt", lpFilePart=0x0) returned 0x83 [0219.104] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec44) returned 1 [0219.104] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Desktop.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs\\desktop.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x614 [0219.105] GetFileType (hFile=0x614) returned 0x1 [0219.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec40) returned 1 [0219.105] GetFileType (hFile=0x614) returned 0x1 [0219.105] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Desktop.txt", nBufferLength=0x105, lpBuffer=0x559e800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Desktop.txt", lpFilePart=0x0) returned 0x83 [0219.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec94) returned 1 [0219.105] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Desktop.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs\\desktop.txt"), fInfoLevelId=0x0, lpFileInformation=0x559ed10 | out: lpFileInformation=0x559ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x433e0390, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x433e0390, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x434064f0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x3ef)) returned 1 [0219.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec90) returned 1 [0219.105] ReadFile (in: hFile=0x614, lpBuffer=0x25ff4e0, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x559ecb8, lpOverlapped=0x0 | out: lpBuffer=0x25ff4e0*, lpNumberOfBytesRead=0x559ecb8*=0x3ef, lpOverlapped=0x0) returned 1 [0219.106] ReadFile (in: hFile=0x614, lpBuffer=0x25ff4e0, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x559ecb8, lpOverlapped=0x0 | out: lpBuffer=0x25ff4e0*, lpNumberOfBytesRead=0x559ecb8*=0x0, lpOverlapped=0x0) returned 1 [0219.106] WriteFile (in: hFile=0x5ec, lpBuffer=0x2550050*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x559ec48, lpOverlapped=0x0 | out: lpBuffer=0x2550050*, lpNumberOfBytesWritten=0x559ec48*=0xc, lpOverlapped=0x0) returned 1 [0219.107] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eae0 | out: lpFindFileData=0x559eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43ade430, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43ade430, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43ade430, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x559, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents.txt", cAlternateFileName="DOCUME~1.TXT")) returned 1 [0219.107] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Documents.txt", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Documents.txt", lpFilePart=0x0) returned 0x85 [0219.107] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Documents.txt", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Documents.txt", lpFilePart=0x0) returned 0x85 [0219.107] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Documents.txt", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Documents.txt", lpFilePart=0x0) returned 0x85 [0219.107] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Documents.txt", nBufferLength=0x105, lpBuffer=0x559e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Documents.txt", lpFilePart=0x0) returned 0x85 [0219.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec44) returned 1 [0219.107] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Documents.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs\\documents.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x614 [0219.107] GetFileType (hFile=0x614) returned 0x1 [0219.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec40) returned 1 [0219.107] GetFileType (hFile=0x614) returned 0x1 [0219.107] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Documents.txt", nBufferLength=0x105, lpBuffer=0x559e800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Documents.txt", lpFilePart=0x0) returned 0x85 [0219.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec94) returned 1 [0219.107] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Documents.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs\\documents.txt"), fInfoLevelId=0x0, lpFileInformation=0x559ed10 | out: lpFileInformation=0x559ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43ade430, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43ade430, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43ade430, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x559)) returned 1 [0219.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec90) returned 1 [0219.108] ReadFile (in: hFile=0x614, lpBuffer=0x2616724, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x559ecb8, lpOverlapped=0x0 | out: lpBuffer=0x2616724*, lpNumberOfBytesRead=0x559ecb8*=0x559, lpOverlapped=0x0) returned 1 [0219.109] ReadFile (in: hFile=0x614, lpBuffer=0x2616724, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x559ecb8, lpOverlapped=0x0 | out: lpBuffer=0x2616724*, lpNumberOfBytesRead=0x559ecb8*=0x0, lpOverlapped=0x0) returned 1 [0219.109] WriteFile (in: hFile=0x5ec, lpBuffer=0x2550050*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x559ec48, lpOverlapped=0x0 | out: lpBuffer=0x2550050*, lpNumberOfBytesWritten=0x559ec48*=0xc, lpOverlapped=0x0) returned 1 [0219.109] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eae0 | out: lpFindFileData=0x559eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43cf3770, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43cf3770, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43cf3770, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads.txt", cAlternateFileName="DOWNLO~1.TXT")) returned 1 [0219.109] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Downloads.txt", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Downloads.txt", lpFilePart=0x0) returned 0x85 [0219.109] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Downloads.txt", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Downloads.txt", lpFilePart=0x0) returned 0x85 [0219.109] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Downloads.txt", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Downloads.txt", lpFilePart=0x0) returned 0x85 [0219.109] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Downloads.txt", nBufferLength=0x105, lpBuffer=0x559e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Downloads.txt", lpFilePart=0x0) returned 0x85 [0219.109] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec44) returned 1 [0219.110] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Downloads.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs\\downloads.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x614 [0219.110] GetFileType (hFile=0x614) returned 0x1 [0219.110] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec40) returned 1 [0219.110] GetFileType (hFile=0x614) returned 0x1 [0219.110] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Downloads.txt", nBufferLength=0x105, lpBuffer=0x559e800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Downloads.txt", lpFilePart=0x0) returned 0x85 [0219.110] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec94) returned 1 [0219.110] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Downloads.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs\\downloads.txt"), fInfoLevelId=0x0, lpFileInformation=0x559ed10 | out: lpFileInformation=0x559ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43cf3770, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43cf3770, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43cf3770, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x1a)) returned 1 [0219.110] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec90) returned 1 [0219.110] ReadFile (in: hFile=0x614, lpBuffer=0x262d968, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x559ecb8, lpOverlapped=0x0 | out: lpBuffer=0x262d968*, lpNumberOfBytesRead=0x559ecb8*=0x1a, lpOverlapped=0x0) returned 1 [0219.111] ReadFile (in: hFile=0x614, lpBuffer=0x262d968, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x559ecb8, lpOverlapped=0x0 | out: lpBuffer=0x262d968*, lpNumberOfBytesRead=0x559ecb8*=0x0, lpOverlapped=0x0) returned 1 [0219.111] WriteFile (in: hFile=0x5ec, lpBuffer=0x2550050*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x559ec48, lpOverlapped=0x0 | out: lpBuffer=0x2550050*, lpNumberOfBytesWritten=0x559ec48*=0xc, lpOverlapped=0x0) returned 1 [0219.111] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eae0 | out: lpFindFileData=0x559eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43b2a6f0, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43b2a6f0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43b2a6f0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x31f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures.txt", cAlternateFileName="")) returned 1 [0219.112] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Pictures.txt", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Pictures.txt", lpFilePart=0x0) returned 0x84 [0219.112] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Pictures.txt", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Pictures.txt", lpFilePart=0x0) returned 0x84 [0219.112] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Pictures.txt", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Pictures.txt", lpFilePart=0x0) returned 0x84 [0219.112] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Pictures.txt", nBufferLength=0x105, lpBuffer=0x559e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Pictures.txt", lpFilePart=0x0) returned 0x84 [0219.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec44) returned 1 [0219.112] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Pictures.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs\\pictures.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x614 [0219.112] GetFileType (hFile=0x614) returned 0x1 [0219.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec40) returned 1 [0219.112] GetFileType (hFile=0x614) returned 0x1 [0219.112] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Pictures.txt", nBufferLength=0x105, lpBuffer=0x559e800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Pictures.txt", lpFilePart=0x0) returned 0x84 [0219.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec94) returned 1 [0219.112] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Pictures.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs\\pictures.txt"), fInfoLevelId=0x0, lpFileInformation=0x559ed10 | out: lpFileInformation=0x559ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43b2a6f0, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43b2a6f0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43b2a6f0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x31f)) returned 1 [0219.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec90) returned 1 [0219.113] ReadFile (in: hFile=0x614, lpBuffer=0x2644b80, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x559ecb8, lpOverlapped=0x0 | out: lpBuffer=0x2644b80*, lpNumberOfBytesRead=0x559ecb8*=0x31f, lpOverlapped=0x0) returned 1 [0219.114] ReadFile (in: hFile=0x614, lpBuffer=0x2644b80, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x559ecb8, lpOverlapped=0x0 | out: lpBuffer=0x2644b80*, lpNumberOfBytesRead=0x559ecb8*=0x0, lpOverlapped=0x0) returned 1 [0219.114] WriteFile (in: hFile=0x5ec, lpBuffer=0x2550050*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x559ec48, lpOverlapped=0x0 | out: lpBuffer=0x2550050*, lpNumberOfBytesWritten=0x559ec48*=0xc, lpOverlapped=0x0) returned 1 [0219.114] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eae0 | out: lpFindFileData=0x559eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43cf3770, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43cf3770, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43cf3770, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Startup.txt", cAlternateFileName="")) returned 1 [0219.115] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Startup.txt", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Startup.txt", lpFilePart=0x0) returned 0x83 [0219.115] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Startup.txt", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Startup.txt", lpFilePart=0x0) returned 0x83 [0219.122] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Startup.txt", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Startup.txt", lpFilePart=0x0) returned 0x83 [0219.122] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Startup.txt", nBufferLength=0x105, lpBuffer=0x559e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Startup.txt", lpFilePart=0x0) returned 0x83 [0219.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec44) returned 1 [0219.122] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Startup.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs\\startup.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x61c [0219.123] GetFileType (hFile=0x61c) returned 0x1 [0219.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec40) returned 1 [0219.123] GetFileType (hFile=0x61c) returned 0x1 [0219.123] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Startup.txt", nBufferLength=0x105, lpBuffer=0x559e800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Startup.txt", lpFilePart=0x0) returned 0x83 [0219.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec94) returned 1 [0219.123] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Startup.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs\\startup.txt"), fInfoLevelId=0x0, lpFileInformation=0x559ed10 | out: lpFileInformation=0x559ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43cf3770, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43cf3770, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43cf3770, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x2e)) returned 1 [0219.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec90) returned 1 [0219.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1.2.3", cchWideChar=5, lpMultiByteStr=0x559eba8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1.2.3\x98ós\x0b9­\x1a\x94ÂOtàøY\x05X\x94Othf¸s", lpUsedDefaultChar=0x0) returned 5 [0219.123] ReadFile (in: hFile=0x61c, lpBuffer=0x24756b4, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x559ecb8, lpOverlapped=0x0 | out: lpBuffer=0x24756b4*, lpNumberOfBytesRead=0x559ecb8*=0x2e, lpOverlapped=0x0) returned 1 [0219.124] ReadFile (in: hFile=0x61c, lpBuffer=0x24756b4, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x559ecb8, lpOverlapped=0x0 | out: lpBuffer=0x24756b4*, lpNumberOfBytesRead=0x559ecb8*=0x0, lpOverlapped=0x0) returned 1 [0219.124] WriteFile (in: hFile=0x5ec, lpBuffer=0x2470dc8*, nNumberOfBytesToWrite=0x5d, lpNumberOfBytesWritten=0x559ec48, lpOverlapped=0x0 | out: lpBuffer=0x2470dc8*, lpNumberOfBytesWritten=0x559ec48*=0x5d, lpOverlapped=0x0) returned 1 [0219.124] SetFilePointer (in: hFile=0x5ec, lDistanceToMove=145860, lpDistanceToMoveHigh=0x559ec5c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x559ec5c*=0) returned 0x239c4 [0219.125] WriteFile (in: hFile=0x5ec, lpBuffer=0x2470dc8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x559ec48, lpOverlapped=0x0 | out: lpBuffer=0x2470dc8*, lpNumberOfBytesWritten=0x559ec48*=0xc, lpOverlapped=0x0) returned 1 [0219.125] SetFilePointer (in: hFile=0x5ec, lDistanceToMove=145939, lpDistanceToMoveHigh=0x559ec5c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x559ec5c*=0) returned 0x23a13 [0219.125] CloseHandle (hObject=0x61c) returned 1 [0219.125] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eae0 | out: lpFindFileData=0x559eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43dfe110, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43dfe110, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43dfe110, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x49f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp.txt", cAlternateFileName="")) returned 1 [0219.125] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Temp.txt", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Temp.txt", lpFilePart=0x0) returned 0x80 [0219.125] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Temp.txt", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Temp.txt", lpFilePart=0x0) returned 0x80 [0219.125] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Temp.txt", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Temp.txt", lpFilePart=0x0) returned 0x80 [0219.125] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Temp.txt", nBufferLength=0x105, lpBuffer=0x559e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Temp.txt", lpFilePart=0x0) returned 0x80 [0219.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec44) returned 1 [0219.125] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Temp.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs\\temp.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x61c [0219.125] GetFileType (hFile=0x61c) returned 0x1 [0219.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec40) returned 1 [0219.126] GetFileType (hFile=0x61c) returned 0x1 [0219.126] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Temp.txt", nBufferLength=0x105, lpBuffer=0x559e800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Temp.txt", lpFilePart=0x0) returned 0x80 [0219.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec94) returned 1 [0219.126] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Temp.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs\\temp.txt"), fInfoLevelId=0x0, lpFileInformation=0x559ed10 | out: lpFileInformation=0x559ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43dfe110, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43dfe110, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43dfe110, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x49f)) returned 1 [0219.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec90) returned 1 [0219.126] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1.2.3", cchWideChar=5, lpMultiByteStr=0x559eba8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1.2.3\x98ós\x0b9­\x1a\x94ÂOtàøY\x05X\x94Othf¸s", lpUsedDefaultChar=0x0) returned 5 [0219.126] ReadFile (in: hFile=0x61c, lpBuffer=0x248c860, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x559ecb8, lpOverlapped=0x0 | out: lpBuffer=0x248c860*, lpNumberOfBytesRead=0x559ecb8*=0x49f, lpOverlapped=0x0) returned 1 [0219.127] ReadFile (in: hFile=0x61c, lpBuffer=0x248c860, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x559ecb8, lpOverlapped=0x0 | out: lpBuffer=0x248c860*, lpNumberOfBytesRead=0x559ecb8*=0x0, lpOverlapped=0x0) returned 1 [0219.127] WriteFile (in: hFile=0x5ec, lpBuffer=0x2470dc8*, nNumberOfBytesToWrite=0x2ee, lpNumberOfBytesWritten=0x559ec48, lpOverlapped=0x0 | out: lpBuffer=0x2470dc8*, lpNumberOfBytesWritten=0x559ec48*=0x2ee, lpOverlapped=0x0) returned 1 [0219.127] SetFilePointer (in: hFile=0x5ec, lDistanceToMove=145953, lpDistanceToMoveHigh=0x559ec5c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x559ec5c*=0) returned 0x23a21 [0219.128] WriteFile (in: hFile=0x5ec, lpBuffer=0x2470dc8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x559ec48, lpOverlapped=0x0 | out: lpBuffer=0x2470dc8*, lpNumberOfBytesWritten=0x559ec48*=0xc, lpOverlapped=0x0) returned 1 [0219.128] SetFilePointer (in: hFile=0x5ec, lDistanceToMove=146689, lpDistanceToMoveHigh=0x559ec5c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x559ec5c*=0) returned 0x23d01 [0219.128] CloseHandle (hObject=0x61c) returned 1 [0219.128] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eae0 | out: lpFindFileData=0x559eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43ccd610, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43ccd610, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43ccd610, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos.txt", cAlternateFileName="")) returned 1 [0219.128] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Videos.txt", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Videos.txt", lpFilePart=0x0) returned 0x82 [0219.128] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Videos.txt", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Videos.txt", lpFilePart=0x0) returned 0x82 [0219.128] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Videos.txt", nBufferLength=0x105, lpBuffer=0x559e810, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Videos.txt", lpFilePart=0x0) returned 0x82 [0219.128] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Videos.txt", nBufferLength=0x105, lpBuffer=0x559e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Videos.txt", lpFilePart=0x0) returned 0x82 [0219.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec44) returned 1 [0219.128] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Videos.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs\\videos.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x61c [0219.128] GetFileType (hFile=0x61c) returned 0x1 [0219.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec40) returned 1 [0219.128] GetFileType (hFile=0x61c) returned 0x1 [0219.129] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Videos.txt", nBufferLength=0x105, lpBuffer=0x559e800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Videos.txt", lpFilePart=0x0) returned 0x82 [0219.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec94) returned 1 [0219.129] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Videos.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs\\videos.txt"), fInfoLevelId=0x0, lpFileInformation=0x559ed10 | out: lpFileInformation=0x559ed10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43ccd610, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43ccd610, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43ccd610, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x2cc)) returned 1 [0219.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ec90) returned 1 [0219.129] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1.2.3", cchWideChar=5, lpMultiByteStr=0x559eba8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1.2.3\x98ós\x0b9­\x1a\x94ÂOtàøY\x05X\x94Othf¸s", lpUsedDefaultChar=0x0) returned 5 [0219.129] ReadFile (in: hFile=0x61c, lpBuffer=0x24a3a40, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x559ecb8, lpOverlapped=0x0 | out: lpBuffer=0x24a3a40*, lpNumberOfBytesRead=0x559ecb8*=0x2cc, lpOverlapped=0x0) returned 1 [0219.130] ReadFile (in: hFile=0x61c, lpBuffer=0x24a3a40, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x559ecb8, lpOverlapped=0x0 | out: lpBuffer=0x24a3a40*, lpNumberOfBytesRead=0x559ecb8*=0x0, lpOverlapped=0x0) returned 1 [0219.130] WriteFile (in: hFile=0x5ec, lpBuffer=0x2470dc8*, nNumberOfBytesToWrite=0x1fb, lpNumberOfBytesWritten=0x559ec48, lpOverlapped=0x0 | out: lpBuffer=0x2470dc8*, lpNumberOfBytesWritten=0x559ec48*=0x1fb, lpOverlapped=0x0) returned 1 [0219.130] SetFilePointer (in: hFile=0x5ec, lDistanceToMove=146703, lpDistanceToMoveHigh=0x559ec5c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x559ec5c*=0) returned 0x23d0f [0219.130] WriteFile (in: hFile=0x5ec, lpBuffer=0x2470dc8*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x559ec48, lpOverlapped=0x0 | out: lpBuffer=0x2470dc8*, lpNumberOfBytesWritten=0x559ec48*=0xc, lpOverlapped=0x0) returned 1 [0219.130] SetFilePointer (in: hFile=0x5ec, lDistanceToMove=147196, lpDistanceToMoveHigh=0x559ec5c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x559ec5c*=0) returned 0x23efc [0219.131] CloseHandle (hObject=0x61c) returned 1 [0219.131] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559eae0 | out: lpFindFileData=0x559eae0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0219.131] FindClose (in: hFindFile=0x60b8ea8 | out: hFindFile=0x60b8ea8) returned 1 [0219.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x559ed68) returned 1 [0219.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x559ed74) returned 1 [0219.140] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x559e7c8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0219.140] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\22e94f5071aaed0706b87ec862736685-mat-debug.tmp", nBufferLength=0x105, lpBuffer=0x559e7dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\22e94f5071aaed0706b87ec862736685-mat-debug.tmp", lpFilePart=0x0) returned 0x80 [0219.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ecd0) returned 1 [0219.140] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\22e94f5071aaed0706b87ec862736685-mat-debug.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\22e94f5071aaed0706b87ec862736685-mat-debug.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x5ec [0219.140] GetFileType (hFile=0x5ec) returned 0x1 [0219.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x559eccc) returned 1 [0219.140] GetFileType (hFile=0x5ec) returned 0x1 [0219.141] SetFilePointer (in: hFile=0x5ec, lDistanceToMove=-18, lpDistanceToMoveHigh=0x559ec58*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x559ec58*=0) returned 0x242a0 [0219.141] SetFilePointer (in: hFile=0x5ec, lDistanceToMove=-32, lpDistanceToMoveHigh=0x559ec20*=-1, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x559ec20*=0) returned 0x24280 [0219.141] ReadFile (in: hFile=0x5ec, lpBuffer=0x24b890c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x559ec10, lpOverlapped=0x0 | out: lpBuffer=0x24b890c*, lpNumberOfBytesRead=0x559ec10*=0x32, lpOverlapped=0x0) returned 1 [0219.141] ReadFile (in: hFile=0x5ec, lpBuffer=0x24b890c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x559ec30, lpOverlapped=0x0 | out: lpBuffer=0x24b890c*, lpNumberOfBytesRead=0x559ec30*=0x16, lpOverlapped=0x0) returned 1 [0219.141] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x559e8d0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0219.142] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Chromium Logins.txt", nBufferLength=0x105, lpBuffer=0x559e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Chromium Logins.txt", lpFilePart=0x0) returned 0x86 [0219.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ed44) returned 1 [0219.142] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Chromium Logins.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\chromium logins.txt"), fInfoLevelId=0x0, lpFileInformation=0x559edc0 | out: lpFileInformation=0x559edc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0219.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x559ed40) returned 1 [0219.142] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x559e8d0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0219.142] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Cookies.txt", nBufferLength=0x105, lpBuffer=0x559e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Cookies.txt", lpFilePart=0x0) returned 0x7e [0219.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ed44) returned 1 [0219.142] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Cookies.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\cookies.txt"), fInfoLevelId=0x0, lpFileInformation=0x559edc0 | out: lpFileInformation=0x559edc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x484a8e30, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x484a8e30, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x484a8e30, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x4f)) returned 1 [0219.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x559ed40) returned 1 [0219.142] SleepEx (dwMilliseconds=0x3e8, bAlertable=1) returned 0x0 [0220.146] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x559e7bc, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0220.147] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\22e94f5071aaed0706b87ec862736685-mat-debug.tmp", nBufferLength=0x105, lpBuffer=0x559e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\22e94f5071aaed0706b87ec862736685-mat-debug.tmp", lpFilePart=0x0) returned 0x80 [0220.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ecc4) returned 1 [0220.147] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\22e94f5071aaed0706b87ec862736685-mat-debug.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\22e94f5071aaed0706b87ec862736685-mat-debug.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x308 [0220.147] GetFileType (hFile=0x308) returned 0x1 [0220.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x559ecc0) returned 1 [0220.147] GetFileType (hFile=0x308) returned 0x1 [0220.147] GetFileSize (in: hFile=0x308, lpFileSizeHigh=0x559edcc | out: lpFileSizeHigh=0x559edcc*=0x0) returned 0x242b2 [0220.148] ReadFile (in: hFile=0x308, lpBuffer=0x348e150, nNumberOfBytesToRead=0x242b2, lpNumberOfBytesRead=0x559ed78, lpOverlapped=0x0 | out: lpBuffer=0x348e150*, lpNumberOfBytesRead=0x559ed78*=0x242b2, lpOverlapped=0x0) returned 1 [0220.149] CloseHandle (hObject=0x308) returned 1 [0220.151] GetComputerNameW (in: lpBuffer=0x559eb8c, nSize=0x559ee04 | out: lpBuffer="XDUWTFONO", nSize=0x559ee04) returned 1 [0220.151] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34298d0, Length=0x20000, ResultLength=0x559ed74 | out: SystemInformation=0x34298d0, ResultLength=0x559ed74*=0x7e60) returned 0x0 [0220.157] GetCurrentProcess () returned 0xffffffff [0220.157] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x559ed58 | out: TokenHandle=0x559ed58*=0x308) returned 1 [0220.157] GetTokenInformation (in: TokenHandle=0x308, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x559ed58 | out: TokenInformation=0x0, ReturnLength=0x559ed58) returned 0 [0220.157] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x99b5b0 [0220.157] GetTokenInformation (in: TokenHandle=0x308, TokenInformationClass=0x8, TokenInformation=0x99b5b0, TokenInformationLength=0x4, ReturnLength=0x559ed58 | out: TokenInformation=0x99b5b0, ReturnLength=0x559ed58) returned 1 [0220.157] LocalFree (hMem=0x99b5b0) returned 0x0 [0220.157] DuplicateTokenEx (in: hExistingToken=0x308, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x559ed60 | out: phNewToken=0x559ed60*=0x380) returned 1 [0220.157] CheckTokenMembership (in: TokenHandle=0x380, SidToCheck=0x24db4c8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x559ed70 | out: IsMember=0x559ed70) returned 1 [0220.157] CloseHandle (hObject=0x380) returned 1 [0220.159] GetComputerNameW (in: lpBuffer=0x559eb8c, nSize=0x559ee04 | out: lpBuffer="XDUWTFONO", nSize=0x559ee04) returned 1 [0220.159] GetUserNameW (in: lpBuffer=0x559eb8c, pcbBuffer=0x559ee04 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x559ee04) returned 1 [0220.167] GetCurrentProcess () returned 0xffffffff [0220.167] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x559ed7c | out: TokenHandle=0x559ed7c*=0x380) returned 1 [0220.168] GetTokenInformation (in: TokenHandle=0x380, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x559ed7c | out: TokenInformation=0x0, ReturnLength=0x559ed7c) returned 0 [0220.168] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x99b5b0 [0220.168] GetTokenInformation (in: TokenHandle=0x380, TokenInformationClass=0x8, TokenInformation=0x99b5b0, TokenInformationLength=0x4, ReturnLength=0x559ed7c | out: TokenInformation=0x99b5b0, ReturnLength=0x559ed7c) returned 1 [0220.168] LocalFree (hMem=0x99b5b0) returned 0x0 [0220.168] DuplicateTokenEx (in: hExistingToken=0x380, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x559ed84 | out: phNewToken=0x559ed84*=0x2a0) returned 1 [0220.168] CheckTokenMembership (in: TokenHandle=0x2a0, SidToCheck=0x24e2c40*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x559ed94 | out: IsMember=0x559ed94) returned 1 [0220.168] CloseHandle (hObject=0x2a0) returned 1 [0220.168] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x559e8e4, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0220.169] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", nBufferLength=0x105, lpBuffer=0x559e8f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", lpFilePart=0x0) returned 0x72 [0220.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x559ed44) returned 1 [0220.169] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89"), fInfoLevelId=0x0, lpFileInformation=0x559edc4 | out: lpFileInformation=0x559edc4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0x4b528e70, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x4b528e70, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0220.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x559ed40) returned 1 [0220.169] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\*", lpFindFileData=0x559ea98 | out: lpFindFileData=0x559ea98*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0x4b528e70, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x4b528e70, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e4a60 [0220.169] FindNextFileW (in: hFindFile=0x9e4a60, lpFindFileData=0x559eaac | out: lpFindFileData=0x559eaac*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0x4b528e70, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x4b528e70, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.169] FindNextFileW (in: hFindFile=0x9e4a60, lpFindFileData=0x559eaac | out: lpFindFileData=0x559eaac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x484a8e30, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x484a8e30, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x484a8e30, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x4f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cookies.txt", cAlternateFileName="")) returned 1 [0220.169] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Cookies.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\cookies.txt")) returned 1 [0220.170] FindNextFileW (in: hFindFile=0x9e4a60, lpFindFileData=0x559eaac | out: lpFindFileData=0x559eaac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x46a9fd90, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x46a9fd90, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x46a9fd90, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBs", cAlternateFileName="")) returned 1 [0220.171] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\*", lpFindFileData=0x559ea48 | out: lpFindFileData=0x559ea48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x46a9fd90, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x46a9fd90, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x46a9fd90, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x60b8ea8 [0220.171] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559ea5c | out: lpFindFileData=0x559ea5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x46a9fd90, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x46a9fd90, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x46a9fd90, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.171] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559ea5c | out: lpFindFileData=0x559ea5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x46a9fd90, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x47791530, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x47791530, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google", cAlternateFileName="")) returned 1 [0220.171] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\*", lpFindFileData=0x559e9f8 | out: lpFindFileData=0x559e9f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x46a9fd90, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x47791530, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x47791530, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x60b8fa8 [0220.171] FindNextFileW (in: hFindFile=0x60b8fa8, lpFindFileData=0x559ea0c | out: lpFindFileData=0x559ea0c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x46a9fd90, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x47791530, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x47791530, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.172] FindNextFileW (in: hFindFile=0x60b8fa8, lpFindFileData=0x559ea0c | out: lpFindFileData=0x559ea0c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x47660a30, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x47660a30, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x98d1e730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0220.172] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dbs\\google\\cookies")) returned 1 [0220.173] FindNextFileW (in: hFindFile=0x60b8fa8, lpFindFileData=0x559ea0c | out: lpFindFileData=0x559ea0c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x47791530, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x47791530, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x9c0bf3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1082a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local State", cAlternateFileName="LOCALS~1")) returned 1 [0220.173] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Local State" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dbs\\google\\local state")) returned 1 [0220.174] FindNextFileW (in: hFindFile=0x60b8fa8, lpFindFileData=0x559ea0c | out: lpFindFileData=0x559ea0c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46a9fd90, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x46a9fd90, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x8124f5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Login Data", cAlternateFileName="LOGIND~1")) returned 1 [0220.174] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Login Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dbs\\google\\login data")) returned 1 [0220.175] FindNextFileW (in: hFindFile=0x60b8fa8, lpFindFileData=0x559ea0c | out: lpFindFileData=0x559ea0c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x46a9fd90, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x46a9fd90, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x8124f5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Login Data", cAlternateFileName="LOGIND~1")) returned 0 [0220.176] FindClose (in: hFindFile=0x60b8fa8 | out: hFindFile=0x60b8fa8) returned 1 [0220.176] RemoveDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dbs\\google")) returned 1 [0220.176] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559ea5c | out: lpFindFileData=0x559ea5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x46a9fd90, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x47791530, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x47791530, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google", cAlternateFileName="")) returned 0 [0220.176] FindClose (in: hFindFile=0x60b8ea8 | out: hFindFile=0x60b8ea8) returned 1 [0220.176] RemoveDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dbs")) returned 1 [0220.176] FindNextFileW (in: hFindFile=0x9e4a60, lpFindFileData=0x559eaac | out: lpFindFileData=0x559eaac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42c49d70, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43dfe110, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43dfe110, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dirs", cAlternateFileName="")) returned 1 [0220.177] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\*", lpFindFileData=0x559ea48 | out: lpFindFileData=0x559ea48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42c49d70, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43dfe110, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43dfe110, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x60b8ea8 [0220.177] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559ea5c | out: lpFindFileData=0x559ea5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42c49d70, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43dfe110, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43dfe110, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.177] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559ea5c | out: lpFindFileData=0x559ea5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x433e0390, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x433e0390, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x434064f0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x3ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.txt", cAlternateFileName="")) returned 1 [0220.177] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Desktop.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs\\desktop.txt")) returned 1 [0220.178] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559ea5c | out: lpFindFileData=0x559ea5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43ade430, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43ade430, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43ade430, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x559, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents.txt", cAlternateFileName="DOCUME~1.TXT")) returned 1 [0220.178] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Documents.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs\\documents.txt")) returned 1 [0220.179] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559ea5c | out: lpFindFileData=0x559ea5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43cf3770, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43cf3770, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43cf3770, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads.txt", cAlternateFileName="DOWNLO~1.TXT")) returned 1 [0220.180] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Downloads.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs\\downloads.txt")) returned 1 [0220.181] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559ea5c | out: lpFindFileData=0x559ea5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43b2a6f0, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43b2a6f0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43b2a6f0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x31f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures.txt", cAlternateFileName="")) returned 1 [0220.181] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Pictures.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs\\pictures.txt")) returned 1 [0220.182] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559ea5c | out: lpFindFileData=0x559ea5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43cf3770, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43cf3770, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43cf3770, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Startup.txt", cAlternateFileName="")) returned 1 [0220.182] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Startup.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs\\startup.txt")) returned 1 [0220.183] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559ea5c | out: lpFindFileData=0x559ea5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43dfe110, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43dfe110, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43dfe110, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x49f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp.txt", cAlternateFileName="")) returned 1 [0220.183] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Temp.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs\\temp.txt")) returned 1 [0220.184] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559ea5c | out: lpFindFileData=0x559ea5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43ccd610, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43ccd610, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43ccd610, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos.txt", cAlternateFileName="")) returned 1 [0220.184] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Videos.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs\\videos.txt")) returned 1 [0220.185] FindNextFileW (in: hFindFile=0x60b8ea8, lpFindFileData=0x559ea5c | out: lpFindFileData=0x559ea5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43ccd610, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43ccd610, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43ccd610, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos.txt", cAlternateFileName="")) returned 0 [0220.185] FindClose (in: hFindFile=0x60b8ea8 | out: hFindFile=0x60b8ea8) returned 1 [0220.185] RemoveDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs")) returned 1 [0220.203] FindNextFileW (in: hFindFile=0x9e4a60, lpFindFileData=0x559eaac | out: lpFindFileData=0x559eaac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4b528e70, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x4b528e70, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x4be88510, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x712, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hardware & Soft.txt", cAlternateFileName="HARDWA~1.TXT")) returned 1 [0220.204] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Hardware & Soft.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\hardware & soft.txt")) returned 1 [0220.205] FindNextFileW (in: hFindFile=0x9e4a60, lpFindFileData=0x559eaac | out: lpFindFileData=0x559eaac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x48cfdb30, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x48cfdb30, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x48cfdb30, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Others.txt", cAlternateFileName="")) returned 1 [0220.205] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Others.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\others.txt")) returned 1 [0220.206] FindNextFileW (in: hFindFile=0x9e4a60, lpFindFileData=0x559eaac | out: lpFindFileData=0x559eaac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42ed14d0, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x42ed14d0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x46eca410, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0xaac, dwReserved0=0x0, dwReserved1=0x0, cFileName="processes.txt", cAlternateFileName="PROCES~1.TXT")) returned 1 [0220.206] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\processes.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\processes.txt")) returned 1 [0220.207] FindNextFileW (in: hFindFile=0x9e4a60, lpFindFileData=0x559eaac | out: lpFindFileData=0x559eaac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4568a3f0, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x4568a3f0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x467f24d0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x17d39, dwReserved0=0x0, dwReserved1=0x0, cFileName="screen.jpeg", cAlternateFileName="SCREEN~1.JPE")) returned 1 [0220.207] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\screen.jpeg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\screen.jpeg")) returned 1 [0220.208] FindNextFileW (in: hFindFile=0x9e4a60, lpFindFileData=0x559eaac | out: lpFindFileData=0x559eaac*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4568a3f0, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x4568a3f0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x467f24d0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x17d39, dwReserved0=0x0, dwReserved1=0x0, cFileName="screen.jpeg", cAlternateFileName="SCREEN~1.JPE")) returned 0 [0220.208] FindClose (in: hFindFile=0x9e4a60 | out: hFindFile=0x9e4a60) returned 1 [0220.209] RemoveDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89")) returned 1 [0220.211] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34298d0, Length=0x20000, ResultLength=0x559ed74 | out: SystemInformation=0x34298d0, ResultLength=0x559ed74*=0x7e60) returned 0x0 [0220.216] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34298d0, Length=0x20000, ResultLength=0x559ed74 | out: SystemInformation=0x34298d0, ResultLength=0x559ed74*=0x7e60) returned 0x0 [0220.217] GetCurrentProcess () returned 0xffffffff [0220.217] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x559ed58 | out: TokenHandle=0x559ed58*=0x2a0) returned 1 [0220.217] GetTokenInformation (in: TokenHandle=0x2a0, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x559ed58 | out: TokenInformation=0x0, ReturnLength=0x559ed58) returned 0 [0220.217] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x99b5b0 [0220.217] GetTokenInformation (in: TokenHandle=0x2a0, TokenInformationClass=0x8, TokenInformation=0x99b5b0, TokenInformationLength=0x4, ReturnLength=0x559ed58 | out: TokenInformation=0x99b5b0, ReturnLength=0x559ed58) returned 1 [0220.217] LocalFree (hMem=0x99b5b0) returned 0x0 [0220.217] DuplicateTokenEx (in: hExistingToken=0x2a0, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x559ed60 | out: phNewToken=0x559ed60*=0x4d4) returned 1 [0220.217] CheckTokenMembership (in: TokenHandle=0x4d4, SidToCheck=0x2506564*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x559ed70 | out: IsMember=0x559ed70) returned 1 [0220.217] CloseHandle (hObject=0x4d4) returned 1 [0220.307] CoCreateGuid (in: pguid=0x559ed94 | out: pguid=0x559ed94*(Data1=0x920b1d6c, Data2=0xb8b6, Data3=0x4a4e, Data4=([0]=0xb1, [1]=0x4d, [2]=0xe5, [3]=0x5b, [4]=0xf0, [5]=0xa9, [6]=0x46, [7]=0x35))) returned 0x0 [0220.348] QueryPerformanceCounter (in: lpPerformanceCount=0x559ecc4 | out: lpPerformanceCount=0x559ecc4*=12960793096) returned 1 [0224.634] CoGetContextToken (in: pToken=0x559ec98 | out: pToken=0x559ec98) returned 0x0 [0224.634] IUnknown:QueryInterface (in: This=0x98faa0, riid=0x7463d8c4*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559ecbc | out: ppvObject=0x559ecbc*=0x98faac) returned 0x0 [0224.634] IComThreadingInfo:GetCurrentThreadType (in: This=0x98faac, pThreadType=0x559ed1c | out: pThreadType=0x559ed1c*=0) returned 0x0 [0224.634] IUnknown:Release (This=0x98faac) returned 0x1 [0224.635] CoGetContextToken (in: pToken=0x559e9b4 | out: pToken=0x559e9b4) returned 0x0 [0224.635] IUnknown:QueryInterface (in: This=0x98faa0, riid=0x7463d8c4*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e9d8 | out: ppvObject=0x559e9d8*=0x98faac) returned 0x0 [0224.635] IComThreadingInfo:GetCurrentThreadType (in: This=0x98faac, pThreadType=0x559ea04 | out: pThreadType=0x559ea04*=0) returned 0x0 [0224.635] IUnknown:Release (This=0x98faac) returned 0x1 [0224.638] CoGetContextToken (in: pToken=0x559e9b4 | out: pToken=0x559e9b4) returned 0x0 [0224.638] IUnknown:QueryInterface (in: This=0x98faa0, riid=0x7463d8c4*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e9d8 | out: ppvObject=0x559e9d8*=0x98faac) returned 0x0 [0224.638] IComThreadingInfo:GetCurrentThreadType (in: This=0x98faac, pThreadType=0x559ea04 | out: pThreadType=0x559ea04*=0) returned 0x0 [0224.638] IUnknown:Release (This=0x98faac) returned 0x1 [0224.668] CoGetContextToken (in: pToken=0x559e9b4 | out: pToken=0x559e9b4) returned 0x0 [0224.668] IUnknown:QueryInterface (in: This=0x98faa0, riid=0x7463d8c4*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e9d8 | out: ppvObject=0x559e9d8*=0x98faac) returned 0x0 [0224.668] IComThreadingInfo:GetCurrentThreadType (in: This=0x98faac, pThreadType=0x559ea04 | out: pThreadType=0x559ea04*=0) returned 0x0 [0224.668] IUnknown:Release (This=0x98faac) returned 0x1 [0224.704] CoGetContextToken (in: pToken=0x559e9cc | out: pToken=0x559e9cc) returned 0x0 [0224.704] IUnknown:QueryInterface (in: This=0x98faa0, riid=0x7463d8c4*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x559e9f0 | out: ppvObject=0x559e9f0*=0x98faac) returned 0x0 [0224.704] IComThreadingInfo:GetCurrentThreadType (in: This=0x98faac, pThreadType=0x559ea1c | out: pThreadType=0x559ea1c*=0) returned 0x0 [0224.704] IUnknown:Release (This=0x98faac) returned 0x1 [0224.708] CoUninitialize () Thread: id = 93 os_tid = 0x224 [0193.367] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0193.371] SleepEx (dwMilliseconds=0x2bc, bAlertable=1) returned 0x0 [0194.067] SleepEx (dwMilliseconds=0x2bc, bAlertable=1) returned 0x0 [0194.782] SleepEx (dwMilliseconds=0x2bc, bAlertable=1) returned 0x0 [0195.499] SleepEx (dwMilliseconds=0x2bc, bAlertable=1) returned 0x0 [0197.077] SleepEx (dwMilliseconds=0x2bc, bAlertable=1) returned 0x0 [0198.144] SleepEx (dwMilliseconds=0x2bc, bAlertable=1) returned 0x0 [0198.899] SleepEx (dwMilliseconds=0x2bc, bAlertable=1) returned 0x0 [0200.032] SleepEx (dwMilliseconds=0x2bc, bAlertable=1) returned 0x0 [0200.838] SleepEx (dwMilliseconds=0x2bc, bAlertable=1) returned 0x0 [0202.237] SleepEx (dwMilliseconds=0x2bc, bAlertable=1) returned 0x0 [0203.192] SleepEx (dwMilliseconds=0x2bc, bAlertable=1) returned 0x0 [0204.074] SleepEx (dwMilliseconds=0x2bc, bAlertable=1) returned 0x0 [0205.115] SleepEx (dwMilliseconds=0x2bc, bAlertable=1) returned 0x0 [0206.436] SleepEx (dwMilliseconds=0x2bc, bAlertable=1) returned 0x0 [0207.356] SleepEx (dwMilliseconds=0x2bc, bAlertable=1) returned 0x0 [0208.775] SleepEx (dwMilliseconds=0x2bc, bAlertable=1) returned 0x0 [0210.030] SleepEx (dwMilliseconds=0x2bc, bAlertable=1) returned 0x0 [0211.101] SleepEx (dwMilliseconds=0x2bc, bAlertable=1) returned 0x0 [0211.956] SleepEx (dwMilliseconds=0x2bc, bAlertable=1) returned 0x0 [0213.158] SleepEx (dwMilliseconds=0x2bc, bAlertable=1) returned 0x0 [0215.186] SleepEx (dwMilliseconds=0x2bc, bAlertable=1) returned 0x0 [0216.512] SleepEx (dwMilliseconds=0x2bc, bAlertable=1) returned 0x0 [0217.214] SleepEx (dwMilliseconds=0x2bc, bAlertable=1) returned 0x0 [0217.915] SleepEx (dwMilliseconds=0x2bc, bAlertable=1) returned 0x0 [0218.806] SleepEx (dwMilliseconds=0x2bc, bAlertable=1) returned 0x0 [0219.569] SleepEx (dwMilliseconds=0x2bc, bAlertable=1) returned 0x0 [0220.276] SleepEx (dwMilliseconds=0x2bc, bAlertable=1) returned 0x0 [0220.973] SleepEx (dwMilliseconds=0x2bc, bAlertable=1) returned 0x0 [0221.675] SleepEx (dwMilliseconds=0x2bc, bAlertable=1) returned 0x0 [0222.377] SleepEx (dwMilliseconds=0x2bc, bAlertable=1) returned 0x0 [0223.079] SleepEx (dwMilliseconds=0x2bc, bAlertable=1) returned 0x0 [0224.093] SleepEx (dwMilliseconds=0x2bc, bAlertable=1) Thread: id = 94 os_tid = 0x648 [0194.541] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0194.542] CoGetContextToken (in: pToken=0x58df9d4 | out: pToken=0x58df9d4) returned 0x0 [0194.542] CObjectContext::QueryInterface () returned 0x0 [0194.542] CObjectContext::GetCurrentThreadType () returned 0x0 [0194.542] Release () returned 0x0 [0194.542] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0194.542] CoUninitialize () [0194.703] LocalAlloc (uFlags=0x0, uBytes=0x11e) returned 0x9b9c38 [0195.400] LocalFree (hMem=0x9c44f8) returned 0x0 [0195.400] LocalFree (hMem=0x9b9c38) returned 0x0 [0195.415] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x58defd4, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0195.416] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\", nBufferLength=0x105, lpBuffer=0x58defe8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\", lpFilePart=0x0) returned 0x78 [0195.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3d0) returned 1 [0195.416] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs"), fInfoLevelId=0x0, lpFileInformation=0x58df44c | out: lpFileInformation=0x58df44c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0195.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3cc) returned 1 [0195.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3d0) returned 1 [0195.416] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs"), fInfoLevelId=0x0, lpFileInformation=0x58df44c | out: lpFileInformation=0x58df44c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0195.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3cc) returned 1 [0195.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3d0) returned 1 [0195.417] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89"), fInfoLevelId=0x0, lpFileInformation=0x58df44c | out: lpFileInformation=0x58df44c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0x42525b70, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x42525b70, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0195.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3cc) returned 1 [0195.417] CreateDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs"), lpSecurityAttributes=0x0) returned 1 [0195.427] CoTaskMemAlloc (cb=0x20c) returned 0x9b9c38 [0195.427] SHGetFolderPathW (in: hwnd=0x0, csidl=0, hToken=0x0, dwFlags=0x0, pszPath=0x9b9c38 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x0 [0195.427] CoTaskMemFree (pv=0x9b9c38) [0195.427] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x58dd7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0195.427] CoTaskMemAlloc (cb=0x20c) returned 0x9b9c38 [0195.427] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x9b9c38 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned 0x0 [0195.427] CoTaskMemFree (pv=0x9b9c38) [0195.427] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", nBufferLength=0x105, lpBuffer=0x58dd7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", lpFilePart=0x0) returned 0x27 [0195.427] CoTaskMemAlloc (cb=0x20c) returned 0x9b9c38 [0195.427] SHGetFolderPathW (in: hwnd=0x0, csidl=39, hToken=0x0, dwFlags=0x0, pszPath=0x9b9c38 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned 0x0 [0195.427] CoTaskMemFree (pv=0x9b9c38) [0195.427] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", nBufferLength=0x105, lpBuffer=0x58dd7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", lpFilePart=0x0) returned 0x26 [0195.427] CoTaskMemAlloc (cb=0x20c) returned 0x9b9c38 [0195.427] SHGetFolderPathW (in: hwnd=0x0, csidl=14, hToken=0x0, dwFlags=0x0, pszPath=0x9b9c38 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned 0x0 [0195.429] CoTaskMemFree (pv=0x9b9c38) [0195.429] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos", nBufferLength=0x105, lpBuffer=0x58dd7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos", lpFilePart=0x0) returned 0x24 [0195.429] CoTaskMemAlloc (cb=0x20c) returned 0x9b9c38 [0195.429] SHGetFolderPathW (in: hwnd=0x0, csidl=7, hToken=0x0, dwFlags=0x0, pszPath=0x9b9c38 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x0 [0195.430] CoTaskMemFree (pv=0x9b9c38) [0195.430] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", nBufferLength=0x105, lpBuffer=0x58dd7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpFilePart=0x0) returned 0x5b [0195.430] CoTaskMemAlloc (cb=0x20c) returned 0x9b9c38 [0195.430] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x9b9c38 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0195.430] CoTaskMemFree (pv=0x9b9c38) [0195.430] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", nBufferLength=0x105, lpBuffer=0x58dd7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d [0195.430] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x58ddc04, nSize=0x80 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x1d [0195.430] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x58ddc04, nSize=0x80 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x1d [0195.430] GetEnvironmentVariableW (in: lpName="TEMP", lpBuffer=0x58ddc04, nSize=0x80 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x24 [0195.454] GetLogicalDrives () returned 0x4 [0195.455] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x58deefc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0195.455] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0195.729] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x58def48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0195.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3a4) returned 1 [0195.730] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x58df420 | out: lpFileInformation=0x58df420*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf53d33f0, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf53d33f0, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0195.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3a0) returned 1 [0195.730] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x58def48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0196.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df410) returned 1 [0196.152] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x58def18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0196.152] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", nBufferLength=0x105, lpBuffer=0x58deeec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpFilePart=0x0) returned 0x26 [0196.160] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*", lpFindFileData=0x58df138 | out: lpFindFileData=0x58df138*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf53d33f0, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf53d33f0, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0196.161] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf53d33f0, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf53d33f0, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0196.161] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a6e5270, ftCreationTime.dwHighDateTime=0x1d5dfb6, ftLastAccessTime.dwLowDateTime=0x7de2ea50, ftLastAccessTime.dwHighDateTime=0x1d5e70a, ftLastWriteTime.dwLowDateTime=0x7de2ea50, ftLastWriteTime.dwHighDateTime=0x1d5e70a, nFileSizeHigh=0x0, nFileSizeLow=0xb426, dwReserved0=0x0, dwReserved1=0x0, cFileName="4Hph0mkGuJ.png", cAlternateFileName="4HPH0M~1.PNG")) returned 1 [0196.161] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4e8230, ftCreationTime.dwHighDateTime=0x1d5dc95, ftLastAccessTime.dwLowDateTime=0x742ce0d0, ftLastAccessTime.dwHighDateTime=0x1d5e609, ftLastWriteTime.dwLowDateTime=0x742ce0d0, ftLastWriteTime.dwHighDateTime=0x1d5e609, nFileSizeHigh=0x0, nFileSizeLow=0x151c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6VhbS.odp", cAlternateFileName="")) returned 1 [0196.161] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x669e1540, ftCreationTime.dwHighDateTime=0x1d5e32c, ftLastAccessTime.dwLowDateTime=0x754cf1c0, ftLastAccessTime.dwHighDateTime=0x1d5dfb1, ftLastWriteTime.dwLowDateTime=0x754cf1c0, ftLastWriteTime.dwHighDateTime=0x1d5dfb1, nFileSizeHigh=0x0, nFileSizeLow=0x9b7d, dwReserved0=0x0, dwReserved1=0x0, cFileName="aF4ak9s5Zj.png", cAlternateFileName="AF4AK9~1.PNG")) returned 1 [0196.161] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b818280, ftCreationTime.dwHighDateTime=0x1d5dc2d, ftLastAccessTime.dwLowDateTime=0xc580d80, ftLastAccessTime.dwHighDateTime=0x1d5e65a, ftLastWriteTime.dwLowDateTime=0xc580d80, ftLastWriteTime.dwHighDateTime=0x1d5e65a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AJk y95ObVpcDBO Afy", cAlternateFileName="AJKY95~1")) returned 1 [0196.162] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad0d1e0, ftCreationTime.dwHighDateTime=0x1d5e4cc, ftLastAccessTime.dwLowDateTime=0x9e5c110, ftLastAccessTime.dwHighDateTime=0x1d5e672, ftLastWriteTime.dwLowDateTime=0x9e5c110, ftLastWriteTime.dwHighDateTime=0x1d5e672, nFileSizeHigh=0x0, nFileSizeLow=0x7f30, dwReserved0=0x0, dwReserved1=0x0, cFileName="aTaNSARGW1v.gif", cAlternateFileName="ATANSA~1.GIF")) returned 1 [0196.162] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fd86630, ftCreationTime.dwHighDateTime=0x1d5e1e3, ftLastAccessTime.dwLowDateTime=0x934884a0, ftLastAccessTime.dwHighDateTime=0x1d5d9bc, ftLastWriteTime.dwLowDateTime=0x934884a0, ftLastWriteTime.dwHighDateTime=0x1d5d9bc, nFileSizeHigh=0x0, nFileSizeLow=0x11705, dwReserved0=0x0, dwReserved1=0x0, cFileName="C6byuV6XtynN.rtf", cAlternateFileName="C6BYUV~1.RTF")) returned 1 [0196.162] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1b9b320, ftCreationTime.dwHighDateTime=0x1d5e7df, ftLastAccessTime.dwLowDateTime=0x47a567d0, ftLastAccessTime.dwHighDateTime=0x1d5daf6, ftLastWriteTime.dwLowDateTime=0x47a567d0, ftLastWriteTime.dwHighDateTime=0x1d5daf6, nFileSizeHigh=0x0, nFileSizeLow=0x8d0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="D-jGT39_f IU2oK3.bmp", cAlternateFileName="D-JGT3~1.BMP")) returned 1 [0196.162] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0196.162] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f759230, ftCreationTime.dwHighDateTime=0x1d5db18, ftLastAccessTime.dwLowDateTime=0x48883c90, ftLastAccessTime.dwHighDateTime=0x1d5e7c1, ftLastWriteTime.dwLowDateTime=0x48883c90, ftLastWriteTime.dwHighDateTime=0x1d5e7c1, nFileSizeHigh=0x0, nFileSizeLow=0x6b5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="DG-HM.png", cAlternateFileName="")) returned 1 [0196.162] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x501a42c0, ftCreationTime.dwHighDateTime=0x1d5dbcb, ftLastAccessTime.dwLowDateTime=0xa0856710, ftLastAccessTime.dwHighDateTime=0x1d5e325, ftLastWriteTime.dwLowDateTime=0xa0856710, ftLastWriteTime.dwHighDateTime=0x1d5e325, nFileSizeHigh=0x0, nFileSizeLow=0xc6c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="diA8WTV8099_fCYwbmU.wav", cAlternateFileName="DIA8WT~1.WAV")) returned 1 [0196.163] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x373de680, ftCreationTime.dwHighDateTime=0x1d5e45e, ftLastAccessTime.dwLowDateTime=0x7d7c73a0, ftLastAccessTime.dwHighDateTime=0x1d5db12, ftLastWriteTime.dwLowDateTime=0x7d7c73a0, ftLastWriteTime.dwHighDateTime=0x1d5db12, nFileSizeHigh=0x0, nFileSizeLow=0x14386, dwReserved0=0x0, dwReserved1=0x0, cFileName="eMjc3dpU8XkVXHNYo.flv", cAlternateFileName="EMJC3D~1.FLV")) returned 1 [0196.163] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc9eeb00, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xcd378180, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0x9cefe300, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x223200, dwReserved0=0x0, dwReserved1=0x0, cFileName="FallGuysStats.exe", cAlternateFileName="FALLGU~1.EXE")) returned 1 [0196.163] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef3477f0, ftCreationTime.dwHighDateTime=0x1d5e5a7, ftLastAccessTime.dwLowDateTime=0x6678f370, ftLastAccessTime.dwHighDateTime=0x1d5d7db, ftLastWriteTime.dwLowDateTime=0x6678f370, ftLastWriteTime.dwHighDateTime=0x1d5d7db, nFileSizeHigh=0x0, nFileSizeLow=0x148b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="HWLR41UsrzX.pptx", cAlternateFileName="HWLR41~1.PPT")) returned 1 [0196.163] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722d7e70, ftCreationTime.dwHighDateTime=0x1d5dea2, ftLastAccessTime.dwLowDateTime=0x920c1a10, ftLastAccessTime.dwHighDateTime=0x1d5e49e, ftLastWriteTime.dwLowDateTime=0x920c1a10, ftLastWriteTime.dwHighDateTime=0x1d5e49e, nFileSizeHigh=0x0, nFileSizeLow=0x351b, dwReserved0=0x0, dwReserved1=0x0, cFileName="iyhY.mp4", cAlternateFileName="")) returned 1 [0196.163] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70499090, ftCreationTime.dwHighDateTime=0x1d5db9f, ftLastAccessTime.dwLowDateTime=0x18ac2870, ftLastAccessTime.dwHighDateTime=0x1d5d81b, ftLastWriteTime.dwLowDateTime=0x18ac2870, ftLastWriteTime.dwHighDateTime=0x1d5d81b, nFileSizeHigh=0x0, nFileSizeLow=0x3a1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="JEeSx_ 9c9l- M8yaw9.mp3", cAlternateFileName="JEESX_~1.MP3")) returned 1 [0196.163] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x927e0f30, ftCreationTime.dwHighDateTime=0x1d5e471, ftLastAccessTime.dwLowDateTime=0xd28423a0, ftLastAccessTime.dwHighDateTime=0x1d5dc4f, ftLastWriteTime.dwLowDateTime=0xd28423a0, ftLastWriteTime.dwHighDateTime=0x1d5dc4f, nFileSizeHigh=0x0, nFileSizeLow=0x2d52, dwReserved0=0x0, dwReserved1=0x0, cFileName="jyGkOjSXtCmGVH0F.flv", cAlternateFileName="JYGKOJ~1.FLV")) returned 1 [0196.164] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xf53d33f0, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf53d33f0, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf55e8730, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x8d800, dwReserved0=0x0, dwReserved1=0x0, cFileName="keys.util", cAlternateFileName="KEYS~1.UTI")) returned 1 [0196.164] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd54276c0, ftCreationTime.dwHighDateTime=0x1d5e125, ftLastAccessTime.dwLowDateTime=0x7ab4fe00, ftLastAccessTime.dwHighDateTime=0x1d5d7d7, ftLastWriteTime.dwLowDateTime=0x7ab4fe00, ftLastWriteTime.dwHighDateTime=0x1d5d7d7, nFileSizeHigh=0x0, nFileSizeLow=0x286c, dwReserved0=0x0, dwReserved1=0x0, cFileName="K_170ChSv1u8Vj1yUw.odt", cAlternateFileName="K_170C~1.ODT")) returned 1 [0196.164] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7149920, ftCreationTime.dwHighDateTime=0x1d5dbbd, ftLastAccessTime.dwLowDateTime=0x6e0fb1a0, ftLastAccessTime.dwHighDateTime=0x1d5deca, ftLastWriteTime.dwLowDateTime=0x6e0fb1a0, ftLastWriteTime.dwHighDateTime=0x1d5deca, nFileSizeHigh=0x0, nFileSizeLow=0x16573, dwReserved0=0x0, dwReserved1=0x0, cFileName="mSwEUqKSIVcu36KpT8Y.ods", cAlternateFileName="MSWEUQ~1.ODS")) returned 1 [0196.164] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe24b440, ftCreationTime.dwHighDateTime=0x1d5db2f, ftLastAccessTime.dwLowDateTime=0x9164bda0, ftLastAccessTime.dwHighDateTime=0x1d5db76, ftLastWriteTime.dwLowDateTime=0x9164bda0, ftLastWriteTime.dwHighDateTime=0x1d5db76, nFileSizeHigh=0x0, nFileSizeLow=0x5d37, dwReserved0=0x0, dwReserved1=0x0, cFileName="NO7u6Yfyqd9wc.mp3", cAlternateFileName="NO7U6Y~1.MP3")) returned 1 [0196.164] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2f1f10, ftCreationTime.dwHighDateTime=0x1d5e512, ftLastAccessTime.dwLowDateTime=0xd6f68e10, ftLastAccessTime.dwHighDateTime=0x1d5e022, ftLastWriteTime.dwLowDateTime=0xd6f68e10, ftLastWriteTime.dwHighDateTime=0x1d5e022, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QyYi21xnW_Hs", cAlternateFileName="QYYI21~1")) returned 1 [0196.164] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x472f8790, ftCreationTime.dwHighDateTime=0x1d5e596, ftLastAccessTime.dwLowDateTime=0xfd11f140, ftLastAccessTime.dwHighDateTime=0x1d5d945, ftLastWriteTime.dwLowDateTime=0xfd11f140, ftLastWriteTime.dwHighDateTime=0x1d5d945, nFileSizeHigh=0x0, nFileSizeLow=0x18341, dwReserved0=0x0, dwReserved1=0x0, cFileName="S 2cbp.jpg", cAlternateFileName="S2CBP~1.JPG")) returned 1 [0196.165] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e8e710, ftCreationTime.dwHighDateTime=0x1d5dd49, ftLastAccessTime.dwLowDateTime=0x183af1b0, ftLastAccessTime.dwHighDateTime=0x1d5da2c, ftLastWriteTime.dwLowDateTime=0x183af1b0, ftLastWriteTime.dwHighDateTime=0x1d5da2c, nFileSizeHigh=0x0, nFileSizeLow=0x43f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="s-MR_A2we.gif", cAlternateFileName="S-MR_A~1.GIF")) returned 1 [0196.165] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf7d97a0, ftCreationTime.dwHighDateTime=0x1d5dbd1, ftLastAccessTime.dwLowDateTime=0xfb5b0470, ftLastAccessTime.dwHighDateTime=0x1d5e725, ftLastWriteTime.dwLowDateTime=0xfb5b0470, ftLastWriteTime.dwHighDateTime=0x1d5e725, nFileSizeHigh=0x0, nFileSizeLow=0x276c, dwReserved0=0x0, dwReserved1=0x0, cFileName="t7KMjQW9rs.png", cAlternateFileName="T7KMJQ~1.PNG")) returned 1 [0196.165] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a2791e0, ftCreationTime.dwHighDateTime=0x1d5de6a, ftLastAccessTime.dwLowDateTime=0xc53c3130, ftLastAccessTime.dwHighDateTime=0x1d5e12a, ftLastWriteTime.dwLowDateTime=0xc53c3130, ftLastWriteTime.dwHighDateTime=0x1d5e12a, nFileSizeHigh=0x0, nFileSizeLow=0x12eac, dwReserved0=0x0, dwReserved1=0x0, cFileName="U8a-Bvcs2ejV.gif", cAlternateFileName="U8A-BV~1.GIF")) returned 1 [0196.165] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a5289e0, ftCreationTime.dwHighDateTime=0x1d5da34, ftLastAccessTime.dwLowDateTime=0xa893c5a0, ftLastAccessTime.dwHighDateTime=0x1d5d952, ftLastWriteTime.dwLowDateTime=0xa893c5a0, ftLastWriteTime.dwHighDateTime=0x1d5d952, nFileSizeHigh=0x0, nFileSizeLow=0x18c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="vuBP6YU W3.swf", cAlternateFileName="VUBP6Y~1.SWF")) returned 1 [0196.165] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6a29c0, ftCreationTime.dwHighDateTime=0x1d5dd3e, ftLastAccessTime.dwLowDateTime=0xabe7e010, ftLastAccessTime.dwHighDateTime=0x1d5e47e, ftLastWriteTime.dwLowDateTime=0xabe7e010, ftLastWriteTime.dwHighDateTime=0x1d5e47e, nFileSizeHigh=0x0, nFileSizeLow=0x4579, dwReserved0=0x0, dwReserved1=0x0, cFileName="W LzDN.swf", cAlternateFileName="WLZDN~1.SWF")) returned 1 [0196.165] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7b87b10, ftCreationTime.dwHighDateTime=0x1d5e096, ftLastAccessTime.dwLowDateTime=0xf9882e00, ftLastAccessTime.dwHighDateTime=0x1d5e137, ftLastWriteTime.dwLowDateTime=0xf9882e00, ftLastWriteTime.dwHighDateTime=0x1d5e137, nFileSizeHigh=0x0, nFileSizeLow=0x1e6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Xgzj4ebzFpd5Qrb6.mkv", cAlternateFileName="XGZJ4E~1.MKV")) returned 1 [0196.166] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb52f8740, ftCreationTime.dwHighDateTime=0x1d5db82, ftLastAccessTime.dwLowDateTime=0x64e3530, ftLastAccessTime.dwHighDateTime=0x1d5d8fa, ftLastWriteTime.dwLowDateTime=0x64e3530, ftLastWriteTime.dwHighDateTime=0x1d5d8fa, nFileSizeHigh=0x0, nFileSizeLow=0x17751, dwReserved0=0x0, dwReserved1=0x0, cFileName="ym 5FDhP_5 -I5BcVgl3.wav", cAlternateFileName="YM5FDH~1.WAV")) returned 1 [0196.166] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb52f8740, ftCreationTime.dwHighDateTime=0x1d5db82, ftLastAccessTime.dwLowDateTime=0x64e3530, ftLastAccessTime.dwHighDateTime=0x1d5d8fa, ftLastWriteTime.dwLowDateTime=0x64e3530, ftLastWriteTime.dwHighDateTime=0x1d5d8fa, nFileSizeHigh=0x0, nFileSizeLow=0x17751, dwReserved0=0x0, dwReserved1=0x0, cFileName="ym 5FDhP_5 -I5BcVgl3.wav", cAlternateFileName="YM5FDH~1.WAV")) returned 0 [0196.166] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0196.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3d0) returned 1 [0196.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3dc) returned 1 [0196.166] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\.", nBufferLength=0x105, lpBuffer=0x58deed0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy", lpFilePart=0x0) returned 0x39 [0196.166] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy", nBufferLength=0x105, lpBuffer=0x58def04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy", lpFilePart=0x0) returned 0x39 [0196.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df360) returned 1 [0196.166] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ajk y95obvpcdbo afy"), fInfoLevelId=0x0, lpFileInformation=0x58df3dc | out: lpFileInformation=0x58df3dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b818280, ftCreationTime.dwHighDateTime=0x1d5dc2d, ftLastAccessTime.dwLowDateTime=0xc580d80, ftLastAccessTime.dwHighDateTime=0x1d5e65a, ftLastWriteTime.dwLowDateTime=0xc580d80, ftLastWriteTime.dwHighDateTime=0x1d5e65a, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0196.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df35c) returned 1 [0196.166] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy", nBufferLength=0x105, lpBuffer=0x58def04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy", lpFilePart=0x0) returned 0x39 [0196.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3cc) returned 1 [0196.167] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy", nBufferLength=0x105, lpBuffer=0x58deed4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy", lpFilePart=0x0) returned 0x39 [0196.167] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\", nBufferLength=0x105, lpBuffer=0x58deea8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\", lpFilePart=0x0) returned 0x3a [0196.167] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\*", lpFindFileData=0x58df0f4 | out: lpFindFileData=0x58df0f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b818280, ftCreationTime.dwHighDateTime=0x1d5dc2d, ftLastAccessTime.dwLowDateTime=0xc580d80, ftLastAccessTime.dwHighDateTime=0x1d5e65a, ftLastWriteTime.dwLowDateTime=0xc580d80, ftLastWriteTime.dwHighDateTime=0x1d5e65a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0196.167] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b818280, ftCreationTime.dwHighDateTime=0x1d5dc2d, ftLastAccessTime.dwLowDateTime=0xc580d80, ftLastAccessTime.dwHighDateTime=0x1d5e65a, ftLastWriteTime.dwLowDateTime=0xc580d80, ftLastWriteTime.dwHighDateTime=0x1d5e65a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0196.167] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe07b19e0, ftCreationTime.dwHighDateTime=0x1d5e70e, ftLastAccessTime.dwLowDateTime=0xe4d74e10, ftLastAccessTime.dwHighDateTime=0x1d5df79, ftLastWriteTime.dwLowDateTime=0xe4d74e10, ftLastWriteTime.dwHighDateTime=0x1d5df79, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AuZZq-okf vUlJtyNYH", cAlternateFileName="AUZZQ-~1")) returned 1 [0196.167] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de344d0, ftCreationTime.dwHighDateTime=0x1d5e4ad, ftLastAccessTime.dwLowDateTime=0xa7bf7b90, ftLastAccessTime.dwHighDateTime=0x1d5d8d7, ftLastWriteTime.dwLowDateTime=0xa7bf7b90, ftLastWriteTime.dwHighDateTime=0x1d5d8d7, nFileSizeHigh=0x0, nFileSizeLow=0xf108, dwReserved0=0x0, dwReserved1=0x0, cFileName="b9FcVnoFNC.png", cAlternateFileName="B9FCVN~1.PNG")) returned 1 [0196.168] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc15503a0, ftCreationTime.dwHighDateTime=0x1d5e2e5, ftLastAccessTime.dwLowDateTime=0xc148c5d0, ftLastAccessTime.dwHighDateTime=0x1d5e5de, ftLastWriteTime.dwLowDateTime=0xc148c5d0, ftLastWriteTime.dwHighDateTime=0x1d5e5de, nFileSizeHigh=0x0, nFileSizeLow=0x9d49, dwReserved0=0x0, dwReserved1=0x0, cFileName="dtXt_TmK9II.mkv", cAlternateFileName="DTXT_T~1.MKV")) returned 1 [0196.168] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75f4d130, ftCreationTime.dwHighDateTime=0x1d5e338, ftLastAccessTime.dwLowDateTime=0x189f490, ftLastAccessTime.dwHighDateTime=0x1d5d935, ftLastWriteTime.dwLowDateTime=0x189f490, ftLastWriteTime.dwHighDateTime=0x1d5d935, nFileSizeHigh=0x0, nFileSizeLow=0x8fdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="jr_Gv20FMbSShkbmmV.png", cAlternateFileName="JR_GV2~1.PNG")) returned 1 [0196.168] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x337eeb30, ftCreationTime.dwHighDateTime=0x1d5e2c8, ftLastAccessTime.dwLowDateTime=0x31e3eeb0, ftLastAccessTime.dwHighDateTime=0x1d5d99a, ftLastWriteTime.dwLowDateTime=0x31e3eeb0, ftLastWriteTime.dwHighDateTime=0x1d5d99a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uq3rwC", cAlternateFileName="")) returned 1 [0196.168] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x548ac960, ftCreationTime.dwHighDateTime=0x1d5e378, ftLastAccessTime.dwLowDateTime=0xe166edc0, ftLastAccessTime.dwHighDateTime=0x1d5dd7c, ftLastWriteTime.dwLowDateTime=0xe166edc0, ftLastWriteTime.dwHighDateTime=0x1d5dd7c, nFileSizeHigh=0x0, nFileSizeLow=0x1317, dwReserved0=0x0, dwReserved1=0x0, cFileName="wodHX9Xmfd7UDCz.png", cAlternateFileName="WODHX9~1.PNG")) returned 1 [0196.168] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17e0fd0, ftCreationTime.dwHighDateTime=0x1d5dc51, ftLastAccessTime.dwLowDateTime=0xe4af0e90, ftLastAccessTime.dwHighDateTime=0x1d5e187, ftLastWriteTime.dwLowDateTime=0xe4af0e90, ftLastWriteTime.dwHighDateTime=0x1d5e187, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_WnqDTffVXM", cAlternateFileName="_WNQDT~1")) returned 1 [0196.168] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0196.168] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0196.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df38c) returned 1 [0196.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df398) returned 1 [0196.169] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\AuZZq-okf vUlJtyNYH\\.", nBufferLength=0x105, lpBuffer=0x58dee8c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\AuZZq-okf vUlJtyNYH", lpFilePart=0x0) returned 0x4d [0196.169] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\AuZZq-okf vUlJtyNYH", nBufferLength=0x105, lpBuffer=0x58deec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\AuZZq-okf vUlJtyNYH", lpFilePart=0x0) returned 0x4d [0196.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df31c) returned 1 [0196.169] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\AuZZq-okf vUlJtyNYH" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ajk y95obvpcdbo afy\\auzzq-okf vuljtynyh"), fInfoLevelId=0x0, lpFileInformation=0x58df398 | out: lpFileInformation=0x58df398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe07b19e0, ftCreationTime.dwHighDateTime=0x1d5e70e, ftLastAccessTime.dwLowDateTime=0xe4d74e10, ftLastAccessTime.dwHighDateTime=0x1d5df79, ftLastWriteTime.dwLowDateTime=0xe4d74e10, ftLastWriteTime.dwHighDateTime=0x1d5df79, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0196.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df318) returned 1 [0196.170] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\AuZZq-okf vUlJtyNYH", nBufferLength=0x105, lpBuffer=0x58deec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\AuZZq-okf vUlJtyNYH", lpFilePart=0x0) returned 0x4d [0196.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df388) returned 1 [0196.170] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\AuZZq-okf vUlJtyNYH", nBufferLength=0x105, lpBuffer=0x58dee90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\AuZZq-okf vUlJtyNYH", lpFilePart=0x0) returned 0x4d [0196.170] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\AuZZq-okf vUlJtyNYH\\", nBufferLength=0x105, lpBuffer=0x58dee64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\AuZZq-okf vUlJtyNYH\\", lpFilePart=0x0) returned 0x4e [0196.170] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\AuZZq-okf vUlJtyNYH\\*", lpFindFileData=0x58df0b0 | out: lpFindFileData=0x58df0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe07b19e0, ftCreationTime.dwHighDateTime=0x1d5e70e, ftLastAccessTime.dwLowDateTime=0xe4d74e10, ftLastAccessTime.dwHighDateTime=0x1d5df79, ftLastWriteTime.dwLowDateTime=0xe4d74e10, ftLastWriteTime.dwHighDateTime=0x1d5df79, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0196.171] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe07b19e0, ftCreationTime.dwHighDateTime=0x1d5e70e, ftLastAccessTime.dwLowDateTime=0xe4d74e10, ftLastAccessTime.dwHighDateTime=0x1d5df79, ftLastWriteTime.dwLowDateTime=0xe4d74e10, ftLastWriteTime.dwHighDateTime=0x1d5df79, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0196.171] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a1b610, ftCreationTime.dwHighDateTime=0x1d5e364, ftLastAccessTime.dwLowDateTime=0x9e227780, ftLastAccessTime.dwHighDateTime=0x1d5d806, ftLastWriteTime.dwLowDateTime=0x9e227780, ftLastWriteTime.dwHighDateTime=0x1d5d806, nFileSizeHigh=0x0, nFileSizeLow=0xc3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ohJPpkFw.mp3", cAlternateFileName="")) returned 1 [0196.171] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe034e4a0, ftCreationTime.dwHighDateTime=0x1d5e125, ftLastAccessTime.dwLowDateTime=0x8da4f600, ftLastAccessTime.dwHighDateTime=0x1d5df25, ftLastWriteTime.dwLowDateTime=0x8da4f600, ftLastWriteTime.dwHighDateTime=0x1d5df25, nFileSizeHigh=0x0, nFileSizeLow=0xe971, dwReserved0=0x0, dwReserved1=0x0, cFileName="om7flqxt.mp4", cAlternateFileName="")) returned 1 [0196.171] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d9e3a20, ftCreationTime.dwHighDateTime=0x1d5d96a, ftLastAccessTime.dwLowDateTime=0x95d06140, ftLastAccessTime.dwHighDateTime=0x1d5e59f, ftLastWriteTime.dwLowDateTime=0x95d06140, ftLastWriteTime.dwHighDateTime=0x1d5e59f, nFileSizeHigh=0x0, nFileSizeLow=0x17f6d, dwReserved0=0x0, dwReserved1=0x0, cFileName="xhE625YkY.mp3", cAlternateFileName="XHE625~1.MP3")) returned 1 [0196.171] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc31e0940, ftCreationTime.dwHighDateTime=0x1d5e716, ftLastAccessTime.dwLowDateTime=0x67c47510, ftLastAccessTime.dwHighDateTime=0x1d5dfc4, ftLastWriteTime.dwLowDateTime=0x67c47510, ftLastWriteTime.dwHighDateTime=0x1d5dfc4, nFileSizeHigh=0x0, nFileSizeLow=0x16257, dwReserved0=0x0, dwReserved1=0x0, cFileName="xOVlScoP915_.bmp", cAlternateFileName="XOVLSC~1.BMP")) returned 1 [0196.171] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc31e0940, ftCreationTime.dwHighDateTime=0x1d5e716, ftLastAccessTime.dwLowDateTime=0x67c47510, ftLastAccessTime.dwHighDateTime=0x1d5dfc4, ftLastWriteTime.dwLowDateTime=0x67c47510, ftLastWriteTime.dwHighDateTime=0x1d5dfc4, nFileSizeHigh=0x0, nFileSizeLow=0x16257, dwReserved0=0x0, dwReserved1=0x0, cFileName="xOVlScoP915_.bmp", cAlternateFileName="XOVLSC~1.BMP")) returned 0 [0196.172] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0196.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df348) returned 1 [0196.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df354) returned 1 [0196.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df388) returned 1 [0196.172] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\AuZZq-okf vUlJtyNYH", nBufferLength=0x105, lpBuffer=0x58dee90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\AuZZq-okf vUlJtyNYH", lpFilePart=0x0) returned 0x4d [0196.173] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\AuZZq-okf vUlJtyNYH\\", nBufferLength=0x105, lpBuffer=0x58dee64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\AuZZq-okf vUlJtyNYH\\", lpFilePart=0x0) returned 0x4e [0196.173] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\AuZZq-okf vUlJtyNYH\\*", lpFindFileData=0x58df0b0 | out: lpFindFileData=0x58df0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe07b19e0, ftCreationTime.dwHighDateTime=0x1d5e70e, ftLastAccessTime.dwLowDateTime=0xe4d74e10, ftLastAccessTime.dwHighDateTime=0x1d5df79, ftLastWriteTime.dwLowDateTime=0xe4d74e10, ftLastWriteTime.dwHighDateTime=0x1d5df79, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0196.173] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe07b19e0, ftCreationTime.dwHighDateTime=0x1d5e70e, ftLastAccessTime.dwLowDateTime=0xe4d74e10, ftLastAccessTime.dwHighDateTime=0x1d5df79, ftLastWriteTime.dwLowDateTime=0xe4d74e10, ftLastWriteTime.dwHighDateTime=0x1d5df79, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0196.174] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a1b610, ftCreationTime.dwHighDateTime=0x1d5e364, ftLastAccessTime.dwLowDateTime=0x9e227780, ftLastAccessTime.dwHighDateTime=0x1d5d806, ftLastWriteTime.dwLowDateTime=0x9e227780, ftLastWriteTime.dwHighDateTime=0x1d5d806, nFileSizeHigh=0x0, nFileSizeLow=0xc3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ohJPpkFw.mp3", cAlternateFileName="")) returned 1 [0196.174] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe034e4a0, ftCreationTime.dwHighDateTime=0x1d5e125, ftLastAccessTime.dwLowDateTime=0x8da4f600, ftLastAccessTime.dwHighDateTime=0x1d5df25, ftLastWriteTime.dwLowDateTime=0x8da4f600, ftLastWriteTime.dwHighDateTime=0x1d5df25, nFileSizeHigh=0x0, nFileSizeLow=0xe971, dwReserved0=0x0, dwReserved1=0x0, cFileName="om7flqxt.mp4", cAlternateFileName="")) returned 1 [0196.174] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d9e3a20, ftCreationTime.dwHighDateTime=0x1d5d96a, ftLastAccessTime.dwLowDateTime=0x95d06140, ftLastAccessTime.dwHighDateTime=0x1d5e59f, ftLastWriteTime.dwLowDateTime=0x95d06140, ftLastWriteTime.dwHighDateTime=0x1d5e59f, nFileSizeHigh=0x0, nFileSizeLow=0x17f6d, dwReserved0=0x0, dwReserved1=0x0, cFileName="xhE625YkY.mp3", cAlternateFileName="XHE625~1.MP3")) returned 1 [0196.174] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc31e0940, ftCreationTime.dwHighDateTime=0x1d5e716, ftLastAccessTime.dwLowDateTime=0x67c47510, ftLastAccessTime.dwHighDateTime=0x1d5dfc4, ftLastWriteTime.dwLowDateTime=0x67c47510, ftLastWriteTime.dwHighDateTime=0x1d5dfc4, nFileSizeHigh=0x0, nFileSizeLow=0x16257, dwReserved0=0x0, dwReserved1=0x0, cFileName="xOVlScoP915_.bmp", cAlternateFileName="XOVLSC~1.BMP")) returned 1 [0196.174] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0196.174] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0196.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df348) returned 1 [0196.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df354) returned 1 [0196.175] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\Uq3rwC\\.", nBufferLength=0x105, lpBuffer=0x58dee8c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\Uq3rwC", lpFilePart=0x0) returned 0x40 [0196.175] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\Uq3rwC", nBufferLength=0x105, lpBuffer=0x58deec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\Uq3rwC", lpFilePart=0x0) returned 0x40 [0196.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df31c) returned 1 [0196.175] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\Uq3rwC" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ajk y95obvpcdbo afy\\uq3rwc"), fInfoLevelId=0x0, lpFileInformation=0x58df398 | out: lpFileInformation=0x58df398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x337eeb30, ftCreationTime.dwHighDateTime=0x1d5e2c8, ftLastAccessTime.dwLowDateTime=0x31e3eeb0, ftLastAccessTime.dwHighDateTime=0x1d5d99a, ftLastWriteTime.dwLowDateTime=0x31e3eeb0, ftLastWriteTime.dwHighDateTime=0x1d5d99a, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0196.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df318) returned 1 [0196.176] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\Uq3rwC", nBufferLength=0x105, lpBuffer=0x58deec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\Uq3rwC", lpFilePart=0x0) returned 0x40 [0196.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df388) returned 1 [0196.176] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\Uq3rwC", nBufferLength=0x105, lpBuffer=0x58dee90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\Uq3rwC", lpFilePart=0x0) returned 0x40 [0196.176] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\Uq3rwC\\", nBufferLength=0x105, lpBuffer=0x58dee64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\Uq3rwC\\", lpFilePart=0x0) returned 0x41 [0196.176] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\Uq3rwC\\*", lpFindFileData=0x58df0b0 | out: lpFindFileData=0x58df0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x337eeb30, ftCreationTime.dwHighDateTime=0x1d5e2c8, ftLastAccessTime.dwLowDateTime=0x31e3eeb0, ftLastAccessTime.dwHighDateTime=0x1d5d99a, ftLastWriteTime.dwLowDateTime=0x31e3eeb0, ftLastWriteTime.dwHighDateTime=0x1d5d99a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0196.177] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x337eeb30, ftCreationTime.dwHighDateTime=0x1d5e2c8, ftLastAccessTime.dwLowDateTime=0x31e3eeb0, ftLastAccessTime.dwHighDateTime=0x1d5d99a, ftLastWriteTime.dwLowDateTime=0x31e3eeb0, ftLastWriteTime.dwHighDateTime=0x1d5d99a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0196.178] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e9d64f0, ftCreationTime.dwHighDateTime=0x1d5e68d, ftLastAccessTime.dwLowDateTime=0xd4f10f20, ftLastAccessTime.dwHighDateTime=0x1d5d995, ftLastWriteTime.dwLowDateTime=0xd4f10f20, ftLastWriteTime.dwHighDateTime=0x1d5d995, nFileSizeHigh=0x0, nFileSizeLow=0x15baa, dwReserved0=0x0, dwReserved1=0x0, cFileName="2JjYy7rxle2WdAkomW s.xls", cAlternateFileName="2JJYY7~1.XLS")) returned 1 [0196.178] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e94e0, ftCreationTime.dwHighDateTime=0x1d5db00, ftLastAccessTime.dwLowDateTime=0xf749aeb0, ftLastAccessTime.dwHighDateTime=0x1d5e624, ftLastWriteTime.dwLowDateTime=0xf749aeb0, ftLastWriteTime.dwHighDateTime=0x1d5e624, nFileSizeHigh=0x0, nFileSizeLow=0x14a3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="aPp84FH_N_-UhGsI un.m4a", cAlternateFileName="APP84F~1.M4A")) returned 1 [0196.178] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x942b9b10, ftCreationTime.dwHighDateTime=0x1d5e514, ftLastAccessTime.dwLowDateTime=0x2b62c210, ftLastAccessTime.dwHighDateTime=0x1d5e2b8, ftLastWriteTime.dwLowDateTime=0x2b62c210, ftLastWriteTime.dwHighDateTime=0x1d5e2b8, nFileSizeHigh=0x0, nFileSizeLow=0xfa35, dwReserved0=0x0, dwReserved1=0x0, cFileName="F5m01gnCVKQ4f.jpg", cAlternateFileName="F5M01G~1.JPG")) returned 1 [0196.178] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x236004b0, ftCreationTime.dwHighDateTime=0x1d5e466, ftLastAccessTime.dwLowDateTime=0x30cde0, ftLastAccessTime.dwHighDateTime=0x1d5dcfe, ftLastWriteTime.dwLowDateTime=0x30cde0, ftLastWriteTime.dwHighDateTime=0x1d5dcfe, nFileSizeHigh=0x0, nFileSizeLow=0xa98d, dwReserved0=0x0, dwReserved1=0x0, cFileName="TwCHyQGTPo_wKDp.m4a", cAlternateFileName="TWCHYQ~1.M4A")) returned 1 [0196.178] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc66e6d0, ftCreationTime.dwHighDateTime=0x1d5e6e4, ftLastAccessTime.dwLowDateTime=0xfe04a340, ftLastAccessTime.dwHighDateTime=0x1d5d814, ftLastWriteTime.dwLowDateTime=0xfe04a340, ftLastWriteTime.dwHighDateTime=0x1d5d814, nFileSizeHigh=0x0, nFileSizeLow=0x15ef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zyg_m58v ambKcCP.ods", cAlternateFileName="ZYG_M5~1.ODS")) returned 1 [0196.178] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc66e6d0, ftCreationTime.dwHighDateTime=0x1d5e6e4, ftLastAccessTime.dwLowDateTime=0xfe04a340, ftLastAccessTime.dwHighDateTime=0x1d5d814, ftLastWriteTime.dwLowDateTime=0xfe04a340, ftLastWriteTime.dwHighDateTime=0x1d5d814, nFileSizeHigh=0x0, nFileSizeLow=0x15ef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zyg_m58v ambKcCP.ods", cAlternateFileName="ZYG_M5~1.ODS")) returned 0 [0196.178] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0196.179] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df348) returned 1 [0196.179] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df354) returned 1 [0196.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df388) returned 1 [0196.179] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\Uq3rwC", nBufferLength=0x105, lpBuffer=0x58dee90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\Uq3rwC", lpFilePart=0x0) returned 0x40 [0196.179] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\Uq3rwC\\", nBufferLength=0x105, lpBuffer=0x58dee64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\Uq3rwC\\", lpFilePart=0x0) returned 0x41 [0196.179] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\Uq3rwC\\*", lpFindFileData=0x58df0b0 | out: lpFindFileData=0x58df0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x337eeb30, ftCreationTime.dwHighDateTime=0x1d5e2c8, ftLastAccessTime.dwLowDateTime=0x31e3eeb0, ftLastAccessTime.dwHighDateTime=0x1d5d99a, ftLastWriteTime.dwLowDateTime=0x31e3eeb0, ftLastWriteTime.dwHighDateTime=0x1d5d99a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0196.180] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x337eeb30, ftCreationTime.dwHighDateTime=0x1d5e2c8, ftLastAccessTime.dwLowDateTime=0x31e3eeb0, ftLastAccessTime.dwHighDateTime=0x1d5d99a, ftLastWriteTime.dwLowDateTime=0x31e3eeb0, ftLastWriteTime.dwHighDateTime=0x1d5d99a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0196.181] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e9d64f0, ftCreationTime.dwHighDateTime=0x1d5e68d, ftLastAccessTime.dwLowDateTime=0xd4f10f20, ftLastAccessTime.dwHighDateTime=0x1d5d995, ftLastWriteTime.dwLowDateTime=0xd4f10f20, ftLastWriteTime.dwHighDateTime=0x1d5d995, nFileSizeHigh=0x0, nFileSizeLow=0x15baa, dwReserved0=0x0, dwReserved1=0x0, cFileName="2JjYy7rxle2WdAkomW s.xls", cAlternateFileName="2JJYY7~1.XLS")) returned 1 [0196.181] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e94e0, ftCreationTime.dwHighDateTime=0x1d5db00, ftLastAccessTime.dwLowDateTime=0xf749aeb0, ftLastAccessTime.dwHighDateTime=0x1d5e624, ftLastWriteTime.dwLowDateTime=0xf749aeb0, ftLastWriteTime.dwHighDateTime=0x1d5e624, nFileSizeHigh=0x0, nFileSizeLow=0x14a3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="aPp84FH_N_-UhGsI un.m4a", cAlternateFileName="APP84F~1.M4A")) returned 1 [0196.181] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x942b9b10, ftCreationTime.dwHighDateTime=0x1d5e514, ftLastAccessTime.dwLowDateTime=0x2b62c210, ftLastAccessTime.dwHighDateTime=0x1d5e2b8, ftLastWriteTime.dwLowDateTime=0x2b62c210, ftLastWriteTime.dwHighDateTime=0x1d5e2b8, nFileSizeHigh=0x0, nFileSizeLow=0xfa35, dwReserved0=0x0, dwReserved1=0x0, cFileName="F5m01gnCVKQ4f.jpg", cAlternateFileName="F5M01G~1.JPG")) returned 1 [0196.181] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x236004b0, ftCreationTime.dwHighDateTime=0x1d5e466, ftLastAccessTime.dwLowDateTime=0x30cde0, ftLastAccessTime.dwHighDateTime=0x1d5dcfe, ftLastWriteTime.dwLowDateTime=0x30cde0, ftLastWriteTime.dwHighDateTime=0x1d5dcfe, nFileSizeHigh=0x0, nFileSizeLow=0xa98d, dwReserved0=0x0, dwReserved1=0x0, cFileName="TwCHyQGTPo_wKDp.m4a", cAlternateFileName="TWCHYQ~1.M4A")) returned 1 [0196.181] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc66e6d0, ftCreationTime.dwHighDateTime=0x1d5e6e4, ftLastAccessTime.dwLowDateTime=0xfe04a340, ftLastAccessTime.dwHighDateTime=0x1d5d814, ftLastWriteTime.dwLowDateTime=0xfe04a340, ftLastWriteTime.dwHighDateTime=0x1d5d814, nFileSizeHigh=0x0, nFileSizeLow=0x15ef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zyg_m58v ambKcCP.ods", cAlternateFileName="ZYG_M5~1.ODS")) returned 1 [0196.181] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0196.182] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0196.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df348) returned 1 [0196.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df354) returned 1 [0196.183] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\_WnqDTffVXM\\.", nBufferLength=0x105, lpBuffer=0x58dee8c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\_WnqDTffVXM", lpFilePart=0x0) returned 0x45 [0196.183] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\_WnqDTffVXM", nBufferLength=0x105, lpBuffer=0x58deec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\_WnqDTffVXM", lpFilePart=0x0) returned 0x45 [0196.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df31c) returned 1 [0196.183] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\_WnqDTffVXM" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ajk y95obvpcdbo afy\\_wnqdtffvxm"), fInfoLevelId=0x0, lpFileInformation=0x58df398 | out: lpFileInformation=0x58df398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17e0fd0, ftCreationTime.dwHighDateTime=0x1d5dc51, ftLastAccessTime.dwLowDateTime=0xe4af0e90, ftLastAccessTime.dwHighDateTime=0x1d5e187, ftLastWriteTime.dwLowDateTime=0xe4af0e90, ftLastWriteTime.dwHighDateTime=0x1d5e187, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0196.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df318) returned 1 [0196.184] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\_WnqDTffVXM", nBufferLength=0x105, lpBuffer=0x58deec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\_WnqDTffVXM", lpFilePart=0x0) returned 0x45 [0196.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df388) returned 1 [0196.184] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\_WnqDTffVXM", nBufferLength=0x105, lpBuffer=0x58dee90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\_WnqDTffVXM", lpFilePart=0x0) returned 0x45 [0196.184] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\_WnqDTffVXM\\", nBufferLength=0x105, lpBuffer=0x58dee64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\_WnqDTffVXM\\", lpFilePart=0x0) returned 0x46 [0196.184] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\_WnqDTffVXM\\*", lpFindFileData=0x58df0b0 | out: lpFindFileData=0x58df0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17e0fd0, ftCreationTime.dwHighDateTime=0x1d5dc51, ftLastAccessTime.dwLowDateTime=0xe4af0e90, ftLastAccessTime.dwHighDateTime=0x1d5e187, ftLastWriteTime.dwLowDateTime=0xe4af0e90, ftLastWriteTime.dwHighDateTime=0x1d5e187, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0196.195] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17e0fd0, ftCreationTime.dwHighDateTime=0x1d5dc51, ftLastAccessTime.dwLowDateTime=0xe4af0e90, ftLastAccessTime.dwHighDateTime=0x1d5e187, ftLastWriteTime.dwLowDateTime=0xe4af0e90, ftLastWriteTime.dwHighDateTime=0x1d5e187, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0196.196] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe53680, ftCreationTime.dwHighDateTime=0x1d5e410, ftLastAccessTime.dwLowDateTime=0x4b30b560, ftLastAccessTime.dwHighDateTime=0x1d5e7c3, ftLastWriteTime.dwLowDateTime=0x4b30b560, ftLastWriteTime.dwHighDateTime=0x1d5e7c3, nFileSizeHigh=0x0, nFileSizeLow=0x9de1, dwReserved0=0x0, dwReserved1=0x0, cFileName="8ClBY-7rWT.mkv", cAlternateFileName="8CLBY-~1.MKV")) returned 1 [0196.196] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4357c1b0, ftCreationTime.dwHighDateTime=0x1d5e540, ftLastAccessTime.dwLowDateTime=0x9a1f1cf0, ftLastAccessTime.dwHighDateTime=0x1d5e365, ftLastWriteTime.dwLowDateTime=0x9a1f1cf0, ftLastWriteTime.dwHighDateTime=0x1d5e365, nFileSizeHigh=0x0, nFileSizeLow=0x4a57, dwReserved0=0x0, dwReserved1=0x0, cFileName="AMrby_.m4a", cAlternateFileName="")) returned 1 [0196.196] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbd17100, ftCreationTime.dwHighDateTime=0x1d5de94, ftLastAccessTime.dwLowDateTime=0x3f96a9f0, ftLastAccessTime.dwHighDateTime=0x1d5d92a, ftLastWriteTime.dwLowDateTime=0x3f96a9f0, ftLastWriteTime.dwHighDateTime=0x1d5d92a, nFileSizeHigh=0x0, nFileSizeLow=0x123ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="VItfp_0jxaA wfc.swf", cAlternateFileName="VITFP_~1.SWF")) returned 1 [0196.196] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed6f2440, ftCreationTime.dwHighDateTime=0x1d5e315, ftLastAccessTime.dwLowDateTime=0xa45e2d00, ftLastAccessTime.dwHighDateTime=0x1d5df0a, ftLastWriteTime.dwLowDateTime=0xa45e2d00, ftLastWriteTime.dwHighDateTime=0x1d5df0a, nFileSizeHigh=0x0, nFileSizeLow=0x1634a, dwReserved0=0x0, dwReserved1=0x0, cFileName="wCbc0x6XzG5tCFOdr.doc", cAlternateFileName="WCBC0X~1.DOC")) returned 1 [0196.196] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x416af3c0, ftCreationTime.dwHighDateTime=0x1d5e7db, ftLastAccessTime.dwLowDateTime=0x7245f950, ftLastAccessTime.dwHighDateTime=0x1d5e6c2, ftLastWriteTime.dwLowDateTime=0x7245f950, ftLastWriteTime.dwHighDateTime=0x1d5e6c2, nFileSizeHigh=0x0, nFileSizeLow=0x116a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="xdHXoGNV31A1y39U7l.avi", cAlternateFileName="XDHXOG~1.AVI")) returned 1 [0196.196] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x416af3c0, ftCreationTime.dwHighDateTime=0x1d5e7db, ftLastAccessTime.dwLowDateTime=0x7245f950, ftLastAccessTime.dwHighDateTime=0x1d5e6c2, ftLastWriteTime.dwLowDateTime=0x7245f950, ftLastWriteTime.dwHighDateTime=0x1d5e6c2, nFileSizeHigh=0x0, nFileSizeLow=0x116a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="xdHXoGNV31A1y39U7l.avi", cAlternateFileName="XDHXOG~1.AVI")) returned 0 [0196.197] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0196.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df348) returned 1 [0196.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df354) returned 1 [0196.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df388) returned 1 [0196.197] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\_WnqDTffVXM", nBufferLength=0x105, lpBuffer=0x58dee90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\_WnqDTffVXM", lpFilePart=0x0) returned 0x45 [0196.197] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\_WnqDTffVXM\\", nBufferLength=0x105, lpBuffer=0x58dee64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\_WnqDTffVXM\\", lpFilePart=0x0) returned 0x46 [0196.198] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\_WnqDTffVXM\\*", lpFindFileData=0x58df0b0 | out: lpFindFileData=0x58df0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17e0fd0, ftCreationTime.dwHighDateTime=0x1d5dc51, ftLastAccessTime.dwLowDateTime=0xe4af0e90, ftLastAccessTime.dwHighDateTime=0x1d5e187, ftLastWriteTime.dwLowDateTime=0xe4af0e90, ftLastWriteTime.dwHighDateTime=0x1d5e187, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0196.198] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17e0fd0, ftCreationTime.dwHighDateTime=0x1d5dc51, ftLastAccessTime.dwLowDateTime=0xe4af0e90, ftLastAccessTime.dwHighDateTime=0x1d5e187, ftLastWriteTime.dwLowDateTime=0xe4af0e90, ftLastWriteTime.dwHighDateTime=0x1d5e187, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0196.199] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe53680, ftCreationTime.dwHighDateTime=0x1d5e410, ftLastAccessTime.dwLowDateTime=0x4b30b560, ftLastAccessTime.dwHighDateTime=0x1d5e7c3, ftLastWriteTime.dwLowDateTime=0x4b30b560, ftLastWriteTime.dwHighDateTime=0x1d5e7c3, nFileSizeHigh=0x0, nFileSizeLow=0x9de1, dwReserved0=0x0, dwReserved1=0x0, cFileName="8ClBY-7rWT.mkv", cAlternateFileName="8CLBY-~1.MKV")) returned 1 [0196.199] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4357c1b0, ftCreationTime.dwHighDateTime=0x1d5e540, ftLastAccessTime.dwLowDateTime=0x9a1f1cf0, ftLastAccessTime.dwHighDateTime=0x1d5e365, ftLastWriteTime.dwLowDateTime=0x9a1f1cf0, ftLastWriteTime.dwHighDateTime=0x1d5e365, nFileSizeHigh=0x0, nFileSizeLow=0x4a57, dwReserved0=0x0, dwReserved1=0x0, cFileName="AMrby_.m4a", cAlternateFileName="")) returned 1 [0196.199] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbd17100, ftCreationTime.dwHighDateTime=0x1d5de94, ftLastAccessTime.dwLowDateTime=0x3f96a9f0, ftLastAccessTime.dwHighDateTime=0x1d5d92a, ftLastWriteTime.dwLowDateTime=0x3f96a9f0, ftLastWriteTime.dwHighDateTime=0x1d5d92a, nFileSizeHigh=0x0, nFileSizeLow=0x123ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="VItfp_0jxaA wfc.swf", cAlternateFileName="VITFP_~1.SWF")) returned 1 [0196.199] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed6f2440, ftCreationTime.dwHighDateTime=0x1d5e315, ftLastAccessTime.dwLowDateTime=0xa45e2d00, ftLastAccessTime.dwHighDateTime=0x1d5df0a, ftLastWriteTime.dwLowDateTime=0xa45e2d00, ftLastWriteTime.dwHighDateTime=0x1d5df0a, nFileSizeHigh=0x0, nFileSizeLow=0x1634a, dwReserved0=0x0, dwReserved1=0x0, cFileName="wCbc0x6XzG5tCFOdr.doc", cAlternateFileName="WCBC0X~1.DOC")) returned 1 [0196.199] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x416af3c0, ftCreationTime.dwHighDateTime=0x1d5e7db, ftLastAccessTime.dwLowDateTime=0x7245f950, ftLastAccessTime.dwHighDateTime=0x1d5e6c2, ftLastWriteTime.dwLowDateTime=0x7245f950, ftLastWriteTime.dwHighDateTime=0x1d5e6c2, nFileSizeHigh=0x0, nFileSizeLow=0x116a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="xdHXoGNV31A1y39U7l.avi", cAlternateFileName="XDHXOG~1.AVI")) returned 1 [0196.199] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0196.199] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0196.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df348) returned 1 [0196.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df354) returned 1 [0196.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3cc) returned 1 [0196.200] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy", nBufferLength=0x105, lpBuffer=0x58deed4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy", lpFilePart=0x0) returned 0x39 [0196.200] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\", nBufferLength=0x105, lpBuffer=0x58deea8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\", lpFilePart=0x0) returned 0x3a [0196.200] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AJk y95ObVpcDBO Afy\\*", lpFindFileData=0x58df0f4 | out: lpFindFileData=0x58df0f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b818280, ftCreationTime.dwHighDateTime=0x1d5dc2d, ftLastAccessTime.dwLowDateTime=0xc580d80, ftLastAccessTime.dwHighDateTime=0x1d5e65a, ftLastWriteTime.dwLowDateTime=0xc580d80, ftLastWriteTime.dwHighDateTime=0x1d5e65a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0196.201] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b818280, ftCreationTime.dwHighDateTime=0x1d5dc2d, ftLastAccessTime.dwLowDateTime=0xc580d80, ftLastAccessTime.dwHighDateTime=0x1d5e65a, ftLastWriteTime.dwLowDateTime=0xc580d80, ftLastWriteTime.dwHighDateTime=0x1d5e65a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0196.201] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe07b19e0, ftCreationTime.dwHighDateTime=0x1d5e70e, ftLastAccessTime.dwLowDateTime=0xe4d74e10, ftLastAccessTime.dwHighDateTime=0x1d5df79, ftLastWriteTime.dwLowDateTime=0xe4d74e10, ftLastWriteTime.dwHighDateTime=0x1d5df79, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AuZZq-okf vUlJtyNYH", cAlternateFileName="AUZZQ-~1")) returned 1 [0196.201] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de344d0, ftCreationTime.dwHighDateTime=0x1d5e4ad, ftLastAccessTime.dwLowDateTime=0xa7bf7b90, ftLastAccessTime.dwHighDateTime=0x1d5d8d7, ftLastWriteTime.dwLowDateTime=0xa7bf7b90, ftLastWriteTime.dwHighDateTime=0x1d5d8d7, nFileSizeHigh=0x0, nFileSizeLow=0xf108, dwReserved0=0x0, dwReserved1=0x0, cFileName="b9FcVnoFNC.png", cAlternateFileName="B9FCVN~1.PNG")) returned 1 [0196.201] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc15503a0, ftCreationTime.dwHighDateTime=0x1d5e2e5, ftLastAccessTime.dwLowDateTime=0xc148c5d0, ftLastAccessTime.dwHighDateTime=0x1d5e5de, ftLastWriteTime.dwLowDateTime=0xc148c5d0, ftLastWriteTime.dwHighDateTime=0x1d5e5de, nFileSizeHigh=0x0, nFileSizeLow=0x9d49, dwReserved0=0x0, dwReserved1=0x0, cFileName="dtXt_TmK9II.mkv", cAlternateFileName="DTXT_T~1.MKV")) returned 1 [0196.201] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75f4d130, ftCreationTime.dwHighDateTime=0x1d5e338, ftLastAccessTime.dwLowDateTime=0x189f490, ftLastAccessTime.dwHighDateTime=0x1d5d935, ftLastWriteTime.dwLowDateTime=0x189f490, ftLastWriteTime.dwHighDateTime=0x1d5d935, nFileSizeHigh=0x0, nFileSizeLow=0x8fdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="jr_Gv20FMbSShkbmmV.png", cAlternateFileName="JR_GV2~1.PNG")) returned 1 [0196.201] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x337eeb30, ftCreationTime.dwHighDateTime=0x1d5e2c8, ftLastAccessTime.dwLowDateTime=0x31e3eeb0, ftLastAccessTime.dwHighDateTime=0x1d5d99a, ftLastWriteTime.dwLowDateTime=0x31e3eeb0, ftLastWriteTime.dwHighDateTime=0x1d5d99a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uq3rwC", cAlternateFileName="")) returned 1 [0196.202] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x548ac960, ftCreationTime.dwHighDateTime=0x1d5e378, ftLastAccessTime.dwLowDateTime=0xe166edc0, ftLastAccessTime.dwHighDateTime=0x1d5dd7c, ftLastWriteTime.dwLowDateTime=0xe166edc0, ftLastWriteTime.dwHighDateTime=0x1d5dd7c, nFileSizeHigh=0x0, nFileSizeLow=0x1317, dwReserved0=0x0, dwReserved1=0x0, cFileName="wodHX9Xmfd7UDCz.png", cAlternateFileName="WODHX9~1.PNG")) returned 1 [0196.202] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17e0fd0, ftCreationTime.dwHighDateTime=0x1d5dc51, ftLastAccessTime.dwLowDateTime=0xe4af0e90, ftLastAccessTime.dwHighDateTime=0x1d5e187, ftLastWriteTime.dwLowDateTime=0xe4af0e90, ftLastWriteTime.dwHighDateTime=0x1d5e187, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_WnqDTffVXM", cAlternateFileName="_WNQDT~1")) returned 1 [0196.202] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17e0fd0, ftCreationTime.dwHighDateTime=0x1d5dc51, ftLastAccessTime.dwLowDateTime=0xe4af0e90, ftLastAccessTime.dwHighDateTime=0x1d5e187, ftLastWriteTime.dwLowDateTime=0xe4af0e90, ftLastWriteTime.dwHighDateTime=0x1d5e187, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_WnqDTffVXM", cAlternateFileName="_WNQDT~1")) returned 0 [0196.202] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0196.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df38c) returned 1 [0196.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df398) returned 1 [0196.202] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QyYi21xnW_Hs\\.", nBufferLength=0x105, lpBuffer=0x58deed0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QyYi21xnW_Hs", lpFilePart=0x0) returned 0x32 [0196.202] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QyYi21xnW_Hs", nBufferLength=0x105, lpBuffer=0x58def04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QyYi21xnW_Hs", lpFilePart=0x0) returned 0x32 [0196.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df360) returned 1 [0196.202] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QyYi21xnW_Hs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qyyi21xnw_hs"), fInfoLevelId=0x0, lpFileInformation=0x58df3dc | out: lpFileInformation=0x58df3dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2f1f10, ftCreationTime.dwHighDateTime=0x1d5e512, ftLastAccessTime.dwLowDateTime=0xd6f68e10, ftLastAccessTime.dwHighDateTime=0x1d5e022, ftLastWriteTime.dwLowDateTime=0xd6f68e10, ftLastWriteTime.dwHighDateTime=0x1d5e022, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0196.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df35c) returned 1 [0196.203] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QyYi21xnW_Hs", nBufferLength=0x105, lpBuffer=0x58def04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QyYi21xnW_Hs", lpFilePart=0x0) returned 0x32 [0196.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3cc) returned 1 [0196.203] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QyYi21xnW_Hs", nBufferLength=0x105, lpBuffer=0x58deed4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QyYi21xnW_Hs", lpFilePart=0x0) returned 0x32 [0196.203] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QyYi21xnW_Hs\\", nBufferLength=0x105, lpBuffer=0x58deea8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QyYi21xnW_Hs\\", lpFilePart=0x0) returned 0x33 [0196.203] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QyYi21xnW_Hs\\*", lpFindFileData=0x58df0f4 | out: lpFindFileData=0x58df0f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2f1f10, ftCreationTime.dwHighDateTime=0x1d5e512, ftLastAccessTime.dwLowDateTime=0xd6f68e10, ftLastAccessTime.dwHighDateTime=0x1d5e022, ftLastWriteTime.dwLowDateTime=0xd6f68e10, ftLastWriteTime.dwHighDateTime=0x1d5e022, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0196.203] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2f1f10, ftCreationTime.dwHighDateTime=0x1d5e512, ftLastAccessTime.dwLowDateTime=0xd6f68e10, ftLastAccessTime.dwHighDateTime=0x1d5e022, ftLastWriteTime.dwLowDateTime=0xd6f68e10, ftLastWriteTime.dwHighDateTime=0x1d5e022, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0196.203] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2f1f10, ftCreationTime.dwHighDateTime=0x1d5e512, ftLastAccessTime.dwLowDateTime=0xd6f68e10, ftLastAccessTime.dwHighDateTime=0x1d5e022, ftLastWriteTime.dwLowDateTime=0xd6f68e10, ftLastWriteTime.dwHighDateTime=0x1d5e022, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0196.203] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0196.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df38c) returned 1 [0196.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df398) returned 1 [0196.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3cc) returned 1 [0196.204] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QyYi21xnW_Hs", nBufferLength=0x105, lpBuffer=0x58deed4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QyYi21xnW_Hs", lpFilePart=0x0) returned 0x32 [0196.204] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QyYi21xnW_Hs\\", nBufferLength=0x105, lpBuffer=0x58deea8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QyYi21xnW_Hs\\", lpFilePart=0x0) returned 0x33 [0196.204] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QyYi21xnW_Hs\\*", lpFindFileData=0x58df0f4 | out: lpFindFileData=0x58df0f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2f1f10, ftCreationTime.dwHighDateTime=0x1d5e512, ftLastAccessTime.dwLowDateTime=0xd6f68e10, ftLastAccessTime.dwHighDateTime=0x1d5e022, ftLastWriteTime.dwLowDateTime=0xd6f68e10, ftLastWriteTime.dwHighDateTime=0x1d5e022, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0196.204] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2f1f10, ftCreationTime.dwHighDateTime=0x1d5e512, ftLastAccessTime.dwLowDateTime=0xd6f68e10, ftLastAccessTime.dwHighDateTime=0x1d5e022, ftLastWriteTime.dwLowDateTime=0xd6f68e10, ftLastWriteTime.dwHighDateTime=0x1d5e022, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0196.204] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2f1f10, ftCreationTime.dwHighDateTime=0x1d5e512, ftLastAccessTime.dwLowDateTime=0xd6f68e10, ftLastAccessTime.dwHighDateTime=0x1d5e022, ftLastWriteTime.dwLowDateTime=0xd6f68e10, ftLastWriteTime.dwHighDateTime=0x1d5e022, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0196.204] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0196.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df38c) returned 1 [0196.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df398) returned 1 [0196.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df410) returned 1 [0196.204] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x58def18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0196.204] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", nBufferLength=0x105, lpBuffer=0x58deeec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpFilePart=0x0) returned 0x26 [0196.205] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*", lpFindFileData=0x58df138 | out: lpFindFileData=0x58df138*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf53d33f0, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf53d33f0, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0196.205] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf53d33f0, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf53d33f0, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0196.205] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a6e5270, ftCreationTime.dwHighDateTime=0x1d5dfb6, ftLastAccessTime.dwLowDateTime=0x7de2ea50, ftLastAccessTime.dwHighDateTime=0x1d5e70a, ftLastWriteTime.dwLowDateTime=0x7de2ea50, ftLastWriteTime.dwHighDateTime=0x1d5e70a, nFileSizeHigh=0x0, nFileSizeLow=0xb426, dwReserved0=0x0, dwReserved1=0x0, cFileName="4Hph0mkGuJ.png", cAlternateFileName="4HPH0M~1.PNG")) returned 1 [0196.205] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4e8230, ftCreationTime.dwHighDateTime=0x1d5dc95, ftLastAccessTime.dwLowDateTime=0x742ce0d0, ftLastAccessTime.dwHighDateTime=0x1d5e609, ftLastWriteTime.dwLowDateTime=0x742ce0d0, ftLastWriteTime.dwHighDateTime=0x1d5e609, nFileSizeHigh=0x0, nFileSizeLow=0x151c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6VhbS.odp", cAlternateFileName="")) returned 1 [0196.205] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x669e1540, ftCreationTime.dwHighDateTime=0x1d5e32c, ftLastAccessTime.dwLowDateTime=0x754cf1c0, ftLastAccessTime.dwHighDateTime=0x1d5dfb1, ftLastWriteTime.dwLowDateTime=0x754cf1c0, ftLastWriteTime.dwHighDateTime=0x1d5dfb1, nFileSizeHigh=0x0, nFileSizeLow=0x9b7d, dwReserved0=0x0, dwReserved1=0x0, cFileName="aF4ak9s5Zj.png", cAlternateFileName="AF4AK9~1.PNG")) returned 1 [0196.205] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b818280, ftCreationTime.dwHighDateTime=0x1d5dc2d, ftLastAccessTime.dwLowDateTime=0xc580d80, ftLastAccessTime.dwHighDateTime=0x1d5e65a, ftLastWriteTime.dwLowDateTime=0xc580d80, ftLastWriteTime.dwHighDateTime=0x1d5e65a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AJk y95ObVpcDBO Afy", cAlternateFileName="AJKY95~1")) returned 1 [0196.206] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad0d1e0, ftCreationTime.dwHighDateTime=0x1d5e4cc, ftLastAccessTime.dwLowDateTime=0x9e5c110, ftLastAccessTime.dwHighDateTime=0x1d5e672, ftLastWriteTime.dwLowDateTime=0x9e5c110, ftLastWriteTime.dwHighDateTime=0x1d5e672, nFileSizeHigh=0x0, nFileSizeLow=0x7f30, dwReserved0=0x0, dwReserved1=0x0, cFileName="aTaNSARGW1v.gif", cAlternateFileName="ATANSA~1.GIF")) returned 1 [0196.206] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fd86630, ftCreationTime.dwHighDateTime=0x1d5e1e3, ftLastAccessTime.dwLowDateTime=0x934884a0, ftLastAccessTime.dwHighDateTime=0x1d5d9bc, ftLastWriteTime.dwLowDateTime=0x934884a0, ftLastWriteTime.dwHighDateTime=0x1d5d9bc, nFileSizeHigh=0x0, nFileSizeLow=0x11705, dwReserved0=0x0, dwReserved1=0x0, cFileName="C6byuV6XtynN.rtf", cAlternateFileName="C6BYUV~1.RTF")) returned 1 [0196.206] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1b9b320, ftCreationTime.dwHighDateTime=0x1d5e7df, ftLastAccessTime.dwLowDateTime=0x47a567d0, ftLastAccessTime.dwHighDateTime=0x1d5daf6, ftLastWriteTime.dwLowDateTime=0x47a567d0, ftLastWriteTime.dwHighDateTime=0x1d5daf6, nFileSizeHigh=0x0, nFileSizeLow=0x8d0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="D-jGT39_f IU2oK3.bmp", cAlternateFileName="D-JGT3~1.BMP")) returned 1 [0196.206] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0196.206] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f759230, ftCreationTime.dwHighDateTime=0x1d5db18, ftLastAccessTime.dwLowDateTime=0x48883c90, ftLastAccessTime.dwHighDateTime=0x1d5e7c1, ftLastWriteTime.dwLowDateTime=0x48883c90, ftLastWriteTime.dwHighDateTime=0x1d5e7c1, nFileSizeHigh=0x0, nFileSizeLow=0x6b5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="DG-HM.png", cAlternateFileName="")) returned 1 [0196.206] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x501a42c0, ftCreationTime.dwHighDateTime=0x1d5dbcb, ftLastAccessTime.dwLowDateTime=0xa0856710, ftLastAccessTime.dwHighDateTime=0x1d5e325, ftLastWriteTime.dwLowDateTime=0xa0856710, ftLastWriteTime.dwHighDateTime=0x1d5e325, nFileSizeHigh=0x0, nFileSizeLow=0xc6c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="diA8WTV8099_fCYwbmU.wav", cAlternateFileName="DIA8WT~1.WAV")) returned 1 [0196.206] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x373de680, ftCreationTime.dwHighDateTime=0x1d5e45e, ftLastAccessTime.dwLowDateTime=0x7d7c73a0, ftLastAccessTime.dwHighDateTime=0x1d5db12, ftLastWriteTime.dwLowDateTime=0x7d7c73a0, ftLastWriteTime.dwHighDateTime=0x1d5db12, nFileSizeHigh=0x0, nFileSizeLow=0x14386, dwReserved0=0x0, dwReserved1=0x0, cFileName="eMjc3dpU8XkVXHNYo.flv", cAlternateFileName="EMJC3D~1.FLV")) returned 1 [0196.206] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc9eeb00, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xcd378180, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0x9cefe300, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x223200, dwReserved0=0x0, dwReserved1=0x0, cFileName="FallGuysStats.exe", cAlternateFileName="FALLGU~1.EXE")) returned 1 [0196.207] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef3477f0, ftCreationTime.dwHighDateTime=0x1d5e5a7, ftLastAccessTime.dwLowDateTime=0x6678f370, ftLastAccessTime.dwHighDateTime=0x1d5d7db, ftLastWriteTime.dwLowDateTime=0x6678f370, ftLastWriteTime.dwHighDateTime=0x1d5d7db, nFileSizeHigh=0x0, nFileSizeLow=0x148b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="HWLR41UsrzX.pptx", cAlternateFileName="HWLR41~1.PPT")) returned 1 [0196.207] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722d7e70, ftCreationTime.dwHighDateTime=0x1d5dea2, ftLastAccessTime.dwLowDateTime=0x920c1a10, ftLastAccessTime.dwHighDateTime=0x1d5e49e, ftLastWriteTime.dwLowDateTime=0x920c1a10, ftLastWriteTime.dwHighDateTime=0x1d5e49e, nFileSizeHigh=0x0, nFileSizeLow=0x351b, dwReserved0=0x0, dwReserved1=0x0, cFileName="iyhY.mp4", cAlternateFileName="")) returned 1 [0196.207] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70499090, ftCreationTime.dwHighDateTime=0x1d5db9f, ftLastAccessTime.dwLowDateTime=0x18ac2870, ftLastAccessTime.dwHighDateTime=0x1d5d81b, ftLastWriteTime.dwLowDateTime=0x18ac2870, ftLastWriteTime.dwHighDateTime=0x1d5d81b, nFileSizeHigh=0x0, nFileSizeLow=0x3a1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="JEeSx_ 9c9l- M8yaw9.mp3", cAlternateFileName="JEESX_~1.MP3")) returned 1 [0196.207] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x927e0f30, ftCreationTime.dwHighDateTime=0x1d5e471, ftLastAccessTime.dwLowDateTime=0xd28423a0, ftLastAccessTime.dwHighDateTime=0x1d5dc4f, ftLastWriteTime.dwLowDateTime=0xd28423a0, ftLastWriteTime.dwHighDateTime=0x1d5dc4f, nFileSizeHigh=0x0, nFileSizeLow=0x2d52, dwReserved0=0x0, dwReserved1=0x0, cFileName="jyGkOjSXtCmGVH0F.flv", cAlternateFileName="JYGKOJ~1.FLV")) returned 1 [0196.207] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xf53d33f0, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf53d33f0, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf55e8730, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x8d800, dwReserved0=0x0, dwReserved1=0x0, cFileName="keys.util", cAlternateFileName="KEYS~1.UTI")) returned 1 [0196.207] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd54276c0, ftCreationTime.dwHighDateTime=0x1d5e125, ftLastAccessTime.dwLowDateTime=0x7ab4fe00, ftLastAccessTime.dwHighDateTime=0x1d5d7d7, ftLastWriteTime.dwLowDateTime=0x7ab4fe00, ftLastWriteTime.dwHighDateTime=0x1d5d7d7, nFileSizeHigh=0x0, nFileSizeLow=0x286c, dwReserved0=0x0, dwReserved1=0x0, cFileName="K_170ChSv1u8Vj1yUw.odt", cAlternateFileName="K_170C~1.ODT")) returned 1 [0196.207] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7149920, ftCreationTime.dwHighDateTime=0x1d5dbbd, ftLastAccessTime.dwLowDateTime=0x6e0fb1a0, ftLastAccessTime.dwHighDateTime=0x1d5deca, ftLastWriteTime.dwLowDateTime=0x6e0fb1a0, ftLastWriteTime.dwHighDateTime=0x1d5deca, nFileSizeHigh=0x0, nFileSizeLow=0x16573, dwReserved0=0x0, dwReserved1=0x0, cFileName="mSwEUqKSIVcu36KpT8Y.ods", cAlternateFileName="MSWEUQ~1.ODS")) returned 1 [0196.208] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe24b440, ftCreationTime.dwHighDateTime=0x1d5db2f, ftLastAccessTime.dwLowDateTime=0x9164bda0, ftLastAccessTime.dwHighDateTime=0x1d5db76, ftLastWriteTime.dwLowDateTime=0x9164bda0, ftLastWriteTime.dwHighDateTime=0x1d5db76, nFileSizeHigh=0x0, nFileSizeLow=0x5d37, dwReserved0=0x0, dwReserved1=0x0, cFileName="NO7u6Yfyqd9wc.mp3", cAlternateFileName="NO7U6Y~1.MP3")) returned 1 [0196.208] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2f1f10, ftCreationTime.dwHighDateTime=0x1d5e512, ftLastAccessTime.dwLowDateTime=0xd6f68e10, ftLastAccessTime.dwHighDateTime=0x1d5e022, ftLastWriteTime.dwLowDateTime=0xd6f68e10, ftLastWriteTime.dwHighDateTime=0x1d5e022, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QyYi21xnW_Hs", cAlternateFileName="QYYI21~1")) returned 1 [0196.208] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x472f8790, ftCreationTime.dwHighDateTime=0x1d5e596, ftLastAccessTime.dwLowDateTime=0xfd11f140, ftLastAccessTime.dwHighDateTime=0x1d5d945, ftLastWriteTime.dwLowDateTime=0xfd11f140, ftLastWriteTime.dwHighDateTime=0x1d5d945, nFileSizeHigh=0x0, nFileSizeLow=0x18341, dwReserved0=0x0, dwReserved1=0x0, cFileName="S 2cbp.jpg", cAlternateFileName="S2CBP~1.JPG")) returned 1 [0196.208] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e8e710, ftCreationTime.dwHighDateTime=0x1d5dd49, ftLastAccessTime.dwLowDateTime=0x183af1b0, ftLastAccessTime.dwHighDateTime=0x1d5da2c, ftLastWriteTime.dwLowDateTime=0x183af1b0, ftLastWriteTime.dwHighDateTime=0x1d5da2c, nFileSizeHigh=0x0, nFileSizeLow=0x43f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="s-MR_A2we.gif", cAlternateFileName="S-MR_A~1.GIF")) returned 1 [0196.208] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf7d97a0, ftCreationTime.dwHighDateTime=0x1d5dbd1, ftLastAccessTime.dwLowDateTime=0xfb5b0470, ftLastAccessTime.dwHighDateTime=0x1d5e725, ftLastWriteTime.dwLowDateTime=0xfb5b0470, ftLastWriteTime.dwHighDateTime=0x1d5e725, nFileSizeHigh=0x0, nFileSizeLow=0x276c, dwReserved0=0x0, dwReserved1=0x0, cFileName="t7KMjQW9rs.png", cAlternateFileName="T7KMJQ~1.PNG")) returned 1 [0196.208] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a2791e0, ftCreationTime.dwHighDateTime=0x1d5de6a, ftLastAccessTime.dwLowDateTime=0xc53c3130, ftLastAccessTime.dwHighDateTime=0x1d5e12a, ftLastWriteTime.dwLowDateTime=0xc53c3130, ftLastWriteTime.dwHighDateTime=0x1d5e12a, nFileSizeHigh=0x0, nFileSizeLow=0x12eac, dwReserved0=0x0, dwReserved1=0x0, cFileName="U8a-Bvcs2ejV.gif", cAlternateFileName="U8A-BV~1.GIF")) returned 1 [0196.209] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a5289e0, ftCreationTime.dwHighDateTime=0x1d5da34, ftLastAccessTime.dwLowDateTime=0xa893c5a0, ftLastAccessTime.dwHighDateTime=0x1d5d952, ftLastWriteTime.dwLowDateTime=0xa893c5a0, ftLastWriteTime.dwHighDateTime=0x1d5d952, nFileSizeHigh=0x0, nFileSizeLow=0x18c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="vuBP6YU W3.swf", cAlternateFileName="VUBP6Y~1.SWF")) returned 1 [0196.209] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6a29c0, ftCreationTime.dwHighDateTime=0x1d5dd3e, ftLastAccessTime.dwLowDateTime=0xabe7e010, ftLastAccessTime.dwHighDateTime=0x1d5e47e, ftLastWriteTime.dwLowDateTime=0xabe7e010, ftLastWriteTime.dwHighDateTime=0x1d5e47e, nFileSizeHigh=0x0, nFileSizeLow=0x4579, dwReserved0=0x0, dwReserved1=0x0, cFileName="W LzDN.swf", cAlternateFileName="WLZDN~1.SWF")) returned 1 [0196.209] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7b87b10, ftCreationTime.dwHighDateTime=0x1d5e096, ftLastAccessTime.dwLowDateTime=0xf9882e00, ftLastAccessTime.dwHighDateTime=0x1d5e137, ftLastWriteTime.dwLowDateTime=0xf9882e00, ftLastWriteTime.dwHighDateTime=0x1d5e137, nFileSizeHigh=0x0, nFileSizeLow=0x1e6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Xgzj4ebzFpd5Qrb6.mkv", cAlternateFileName="XGZJ4E~1.MKV")) returned 1 [0196.209] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb52f8740, ftCreationTime.dwHighDateTime=0x1d5db82, ftLastAccessTime.dwLowDateTime=0x64e3530, ftLastAccessTime.dwHighDateTime=0x1d5d8fa, ftLastWriteTime.dwLowDateTime=0x64e3530, ftLastWriteTime.dwHighDateTime=0x1d5d8fa, nFileSizeHigh=0x0, nFileSizeLow=0x17751, dwReserved0=0x0, dwReserved1=0x0, cFileName="ym 5FDhP_5 -I5BcVgl3.wav", cAlternateFileName="YM5FDH~1.WAV")) returned 1 [0196.209] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0196.209] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0196.209] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3d0) returned 1 [0196.209] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3dc) returned 1 [0196.212] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x58def7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0196.214] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x58dee1c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0196.214] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Desktop.txt", nBufferLength=0x105, lpBuffer=0x58dee30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Desktop.txt", lpFilePart=0x0) returned 0x83 [0196.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df324) returned 1 [0196.215] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Desktop.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs\\desktop.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x4b0 [0196.215] GetFileType (hFile=0x4b0) returned 0x1 [0196.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df320) returned 1 [0196.215] GetFileType (hFile=0x4b0) returned 0x1 [0196.216] WriteFile (in: hFile=0x4b0, lpBuffer=0x24a4898*, nNumberOfBytesToWrite=0x3ef, lpNumberOfBytesWritten=0x58df3bc, lpOverlapped=0x0 | out: lpBuffer=0x24a4898*, lpNumberOfBytesWritten=0x58df3bc*=0x3ef, lpOverlapped=0x0) returned 1 [0196.217] CloseHandle (hObject=0x4b0) returned 1 [0196.217] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", nBufferLength=0x105, lpBuffer=0x58def48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", lpFilePart=0x0) returned 0x27 [0196.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3a4) returned 1 [0196.217] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents"), fInfoLevelId=0x0, lpFileInformation=0x58df420 | out: lpFileInformation=0x58df420*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdbe2d4a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbe2d4a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0196.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3a0) returned 1 [0196.218] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", nBufferLength=0x105, lpBuffer=0x58def48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", lpFilePart=0x0) returned 0x27 [0196.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df410) returned 1 [0196.218] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", nBufferLength=0x105, lpBuffer=0x58def18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", lpFilePart=0x0) returned 0x27 [0196.218] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", nBufferLength=0x105, lpBuffer=0x58deeec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", lpFilePart=0x0) returned 0x28 [0196.218] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*", lpFindFileData=0x58df138 | out: lpFindFileData=0x58df138*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdbe2d4a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbe2d4a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0196.218] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdbe2d4a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbe2d4a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.079] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc0cd120, ftCreationTime.dwHighDateTime=0x1d58431, ftLastAccessTime.dwLowDateTime=0xdea7f8a0, ftLastAccessTime.dwHighDateTime=0x1d5c4c1, ftLastWriteTime.dwLowDateTime=0xdea7f8a0, ftLastWriteTime.dwHighDateTime=0x1d5c4c1, nFileSizeHigh=0x0, nFileSizeLow=0x677e, dwReserved0=0x0, dwReserved1=0x0, cFileName="8-y4LOfY.xlsx", cAlternateFileName="8-Y4LO~1.XLS")) returned 1 [0197.079] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4363460, ftCreationTime.dwHighDateTime=0x1d57957, ftLastAccessTime.dwLowDateTime=0x84e126c0, ftLastAccessTime.dwHighDateTime=0x1d5e65e, ftLastWriteTime.dwLowDateTime=0x84e126c0, ftLastWriteTime.dwHighDateTime=0x1d5e65e, nFileSizeHigh=0x0, nFileSizeLow=0x11d97, dwReserved0=0x0, dwReserved1=0x0, cFileName="82nzDGjI 7XWXV_l.xlsx", cAlternateFileName="82NZDG~1.XLS")) returned 1 [0197.079] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40528c90, ftCreationTime.dwHighDateTime=0x1d5ae0c, ftLastAccessTime.dwLowDateTime=0x47d76e50, ftLastAccessTime.dwHighDateTime=0x1d56608, ftLastWriteTime.dwLowDateTime=0x47d76e50, ftLastWriteTime.dwHighDateTime=0x1d56608, nFileSizeHigh=0x0, nFileSizeLow=0xc77f, dwReserved0=0x0, dwReserved1=0x0, cFileName="8nrt26S7PviA02dyk.pptx", cAlternateFileName="8NRT26~1.PPT")) returned 1 [0197.079] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bb6c3f0, ftCreationTime.dwHighDateTime=0x1d55b36, ftLastAccessTime.dwLowDateTime=0x94f6d9a0, ftLastAccessTime.dwHighDateTime=0x1d5a6b3, ftLastWriteTime.dwLowDateTime=0x94f6d9a0, ftLastWriteTime.dwHighDateTime=0x1d5a6b3, nFileSizeHigh=0x0, nFileSizeLow=0x10517, dwReserved0=0x0, dwReserved1=0x0, cFileName="aV3XYxvgegC.docx", cAlternateFileName="AV3XYX~1.DOC")) returned 1 [0197.080] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddba0680, ftCreationTime.dwHighDateTime=0x1d5e3cb, ftLastAccessTime.dwLowDateTime=0xe835b1c0, ftLastAccessTime.dwHighDateTime=0x1d5e1de, ftLastWriteTime.dwLowDateTime=0xe835b1c0, ftLastWriteTime.dwHighDateTime=0x1d5e1de, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="b80m5N3teF4Nk1P", cAlternateFileName="B80M5N~1")) returned 1 [0197.080] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0197.080] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fbfcc80, ftCreationTime.dwHighDateTime=0x1d5b650, ftLastAccessTime.dwLowDateTime=0x7a8995f0, ftLastAccessTime.dwHighDateTime=0x1d5dee2, ftLastWriteTime.dwLowDateTime=0x7a8995f0, ftLastWriteTime.dwHighDateTime=0x1d5dee2, nFileSizeHigh=0x0, nFileSizeLow=0x12ca8, dwReserved0=0x0, dwReserved1=0x0, cFileName="gcBW 4OQaj.pptx", cAlternateFileName="GCBW4O~1.PPT")) returned 1 [0197.080] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4727ea0, ftCreationTime.dwHighDateTime=0x1d5a84b, ftLastAccessTime.dwLowDateTime=0x9643e170, ftLastAccessTime.dwHighDateTime=0x1d56d2b, ftLastWriteTime.dwLowDateTime=0x9643e170, ftLastWriteTime.dwHighDateTime=0x1d56d2b, nFileSizeHigh=0x0, nFileSizeLow=0xc01d, dwReserved0=0x0, dwReserved1=0x0, cFileName="gqp9rLKCCKsd05.docx", cAlternateFileName="GQP9RL~1.DOC")) returned 1 [0197.080] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0f4c730, ftCreationTime.dwHighDateTime=0x1d5d912, ftLastAccessTime.dwLowDateTime=0x4ee4cfe0, ftLastAccessTime.dwHighDateTime=0x1d5d871, ftLastWriteTime.dwLowDateTime=0x4ee4cfe0, ftLastWriteTime.dwHighDateTime=0x1d5d871, nFileSizeHigh=0x0, nFileSizeLow=0x133a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="h8I86FUVFr.docx", cAlternateFileName="H8I86F~1.DOC")) returned 1 [0197.080] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7fcb00, ftCreationTime.dwHighDateTime=0x1d5c170, ftLastAccessTime.dwLowDateTime=0x55e037b0, ftLastAccessTime.dwHighDateTime=0x1d5d297, ftLastWriteTime.dwLowDateTime=0x55e037b0, ftLastWriteTime.dwHighDateTime=0x1d5d297, nFileSizeHigh=0x0, nFileSizeLow=0x16388, dwReserved0=0x0, dwReserved1=0x0, cFileName="jQFpDdnAiB98NT.docx", cAlternateFileName="JQFPDD~1.DOC")) returned 1 [0197.081] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec194c0, ftCreationTime.dwHighDateTime=0x1d58036, ftLastAccessTime.dwLowDateTime=0xc3abd700, ftLastAccessTime.dwHighDateTime=0x1d5de26, ftLastWriteTime.dwLowDateTime=0xc3abd700, ftLastWriteTime.dwHighDateTime=0x1d5de26, nFileSizeHigh=0x0, nFileSizeLow=0x1303d, dwReserved0=0x0, dwReserved1=0x0, cFileName="KskcceHMsX7rT.xlsx", cAlternateFileName="KSKCCE~1.XLS")) returned 1 [0197.081] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0197.081] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0197.081] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0197.081] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0197.081] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ddcd580, ftCreationTime.dwHighDateTime=0x1d5a5f2, ftLastAccessTime.dwLowDateTime=0xea013500, ftLastAccessTime.dwHighDateTime=0x1d56160, ftLastWriteTime.dwLowDateTime=0xea013500, ftLastWriteTime.dwHighDateTime=0x1d56160, nFileSizeHigh=0x0, nFileSizeLow=0xd513, dwReserved0=0x0, dwReserved1=0x0, cFileName="nlXNmDoCq.pptx", cAlternateFileName="NLXNMD~1.PPT")) returned 1 [0197.082] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5f72ff0, ftCreationTime.dwHighDateTime=0x1d5a3ea, ftLastAccessTime.dwLowDateTime=0x76911260, ftLastAccessTime.dwHighDateTime=0x1d5a8ba, ftLastWriteTime.dwLowDateTime=0x76911260, ftLastWriteTime.dwHighDateTime=0x1d5a8ba, nFileSizeHigh=0x0, nFileSizeLow=0x1190c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oiYNJq9q1YIrgX.docx", cAlternateFileName="OIYNJQ~1.DOC")) returned 1 [0197.082] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8a4af3c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8a4af3c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0197.082] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedc3a100, ftCreationTime.dwHighDateTime=0x1d5dfa0, ftLastAccessTime.dwLowDateTime=0x63e311d0, ftLastAccessTime.dwHighDateTime=0x1d5db06, ftLastWriteTime.dwLowDateTime=0x63e311d0, ftLastWriteTime.dwHighDateTime=0x1d5db06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oX2xE8wIX", cAlternateFileName="OX2XE8~1")) returned 1 [0197.082] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78e00870, ftCreationTime.dwHighDateTime=0x1d59ca6, ftLastAccessTime.dwLowDateTime=0xb4a95c30, ftLastAccessTime.dwHighDateTime=0x1d580bd, ftLastWriteTime.dwLowDateTime=0xb4a95c30, ftLastWriteTime.dwHighDateTime=0x1d580bd, nFileSizeHigh=0x0, nFileSizeLow=0x930d, dwReserved0=0x0, dwReserved1=0x0, cFileName="PFyZqu_bN8iiDcWbYu.docx", cAlternateFileName="PFYZQU~1.DOC")) returned 1 [0197.082] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe817f210, ftCreationTime.dwHighDateTime=0x1d5e7e8, ftLastAccessTime.dwLowDateTime=0xf4cbeb50, ftLastAccessTime.dwHighDateTime=0x1d57ba6, ftLastWriteTime.dwLowDateTime=0xf4cbeb50, ftLastWriteTime.dwHighDateTime=0x1d57ba6, nFileSizeHigh=0x0, nFileSizeLow=0x178c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qAMKrJ s5aXEM2 DfBx.xlsx", cAlternateFileName="QAMKRJ~1.XLS")) returned 1 [0197.082] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a2ea540, ftCreationTime.dwHighDateTime=0x1d5da48, ftLastAccessTime.dwLowDateTime=0x52cdcad0, ftLastAccessTime.dwHighDateTime=0x1d5db9b, ftLastWriteTime.dwLowDateTime=0x52cdcad0, ftLastWriteTime.dwHighDateTime=0x1d5db9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QmUng5_ZXRVu", cAlternateFileName="QMUNG5~1")) returned 1 [0197.082] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a7ac60, ftCreationTime.dwHighDateTime=0x1d5e050, ftLastAccessTime.dwLowDateTime=0x44695690, ftLastAccessTime.dwHighDateTime=0x1d5d8fc, ftLastWriteTime.dwLowDateTime=0x44695690, ftLastWriteTime.dwHighDateTime=0x1d5d8fc, nFileSizeHigh=0x0, nFileSizeLow=0x11028, dwReserved0=0x0, dwReserved1=0x0, cFileName="R6MuKWr660ExY0xOP1YZ.doc", cAlternateFileName="R6MUKW~1.DOC")) returned 1 [0197.083] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x827cc010, ftCreationTime.dwHighDateTime=0x1d5d95c, ftLastAccessTime.dwLowDateTime=0x2b1954f0, ftLastAccessTime.dwHighDateTime=0x1d5def2, ftLastWriteTime.dwLowDateTime=0x2b1954f0, ftLastWriteTime.dwHighDateTime=0x1d5def2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rIREdumyZRX80jt2", cAlternateFileName="RIREDU~1")) returned 1 [0197.083] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdecb2f10, ftCreationTime.dwHighDateTime=0x1d5d8ac, ftLastAccessTime.dwLowDateTime=0x93a8cb30, ftLastAccessTime.dwHighDateTime=0x1d5bafe, ftLastWriteTime.dwLowDateTime=0x93a8cb30, ftLastWriteTime.dwHighDateTime=0x1d5bafe, nFileSizeHigh=0x0, nFileSizeLow=0x67cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RPane0VXyl-S.pptx", cAlternateFileName="RPANE0~1.PPT")) returned 1 [0197.083] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbeb1ff0, ftCreationTime.dwHighDateTime=0x1d568b4, ftLastAccessTime.dwLowDateTime=0x55cd4140, ftLastAccessTime.dwHighDateTime=0x1d5b6d2, ftLastWriteTime.dwLowDateTime=0x55cd4140, ftLastWriteTime.dwHighDateTime=0x1d5b6d2, nFileSizeHigh=0x0, nFileSizeLow=0xf4a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="XErx7u1YawDfT4d.xlsx", cAlternateFileName="XERX7U~1.XLS")) returned 1 [0197.083] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0124330, ftCreationTime.dwHighDateTime=0x1d56c09, ftLastAccessTime.dwLowDateTime=0x4e92e4d0, ftLastAccessTime.dwHighDateTime=0x1d59c64, ftLastWriteTime.dwLowDateTime=0x4e92e4d0, ftLastWriteTime.dwHighDateTime=0x1d59c64, nFileSizeHigh=0x0, nFileSizeLow=0x819b, dwReserved0=0x0, dwReserved1=0x0, cFileName="yEsc.pptx", cAlternateFileName="YESC~1.PPT")) returned 1 [0197.083] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0124330, ftCreationTime.dwHighDateTime=0x1d56c09, ftLastAccessTime.dwLowDateTime=0x4e92e4d0, ftLastAccessTime.dwHighDateTime=0x1d59c64, ftLastWriteTime.dwLowDateTime=0x4e92e4d0, ftLastWriteTime.dwHighDateTime=0x1d59c64, nFileSizeHigh=0x0, nFileSizeLow=0x819b, dwReserved0=0x0, dwReserved1=0x0, cFileName="yEsc.pptx", cAlternateFileName="YESC~1.PPT")) returned 0 [0197.084] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0197.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3d0) returned 1 [0197.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3dc) returned 1 [0197.084] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\.", nBufferLength=0x105, lpBuffer=0x58deed0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P", lpFilePart=0x0) returned 0x37 [0197.084] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P", nBufferLength=0x105, lpBuffer=0x58def04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P", lpFilePart=0x0) returned 0x37 [0197.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df360) returned 1 [0197.084] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\b80m5n3tef4nk1p"), fInfoLevelId=0x0, lpFileInformation=0x58df3dc | out: lpFileInformation=0x58df3dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddba0680, ftCreationTime.dwHighDateTime=0x1d5e3cb, ftLastAccessTime.dwLowDateTime=0xe835b1c0, ftLastAccessTime.dwHighDateTime=0x1d5e1de, ftLastWriteTime.dwLowDateTime=0xe835b1c0, ftLastWriteTime.dwHighDateTime=0x1d5e1de, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0197.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df35c) returned 1 [0197.140] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P", nBufferLength=0x105, lpBuffer=0x58def04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P", lpFilePart=0x0) returned 0x37 [0197.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3cc) returned 1 [0197.140] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P", nBufferLength=0x105, lpBuffer=0x58deed4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P", lpFilePart=0x0) returned 0x37 [0197.140] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\", nBufferLength=0x105, lpBuffer=0x58deea8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\", lpFilePart=0x0) returned 0x38 [0197.141] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\*", lpFindFileData=0x58df0f4 | out: lpFindFileData=0x58df0f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddba0680, ftCreationTime.dwHighDateTime=0x1d5e3cb, ftLastAccessTime.dwLowDateTime=0xe835b1c0, ftLastAccessTime.dwHighDateTime=0x1d5e1de, ftLastWriteTime.dwLowDateTime=0xe835b1c0, ftLastWriteTime.dwHighDateTime=0x1d5e1de, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0197.184] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddba0680, ftCreationTime.dwHighDateTime=0x1d5e3cb, ftLastAccessTime.dwLowDateTime=0xe835b1c0, ftLastAccessTime.dwHighDateTime=0x1d5e1de, ftLastWriteTime.dwLowDateTime=0xe835b1c0, ftLastWriteTime.dwHighDateTime=0x1d5e1de, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.185] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bac0e0, ftCreationTime.dwHighDateTime=0x1d5e33a, ftLastAccessTime.dwLowDateTime=0x199c9d90, ftLastAccessTime.dwHighDateTime=0x1d5da79, ftLastWriteTime.dwLowDateTime=0x199c9d90, ftLastWriteTime.dwHighDateTime=0x1d5da79, nFileSizeHigh=0x0, nFileSizeLow=0x16ff3, dwReserved0=0x0, dwReserved1=0x0, cFileName="8oXu73Kth0ycR3.doc", cAlternateFileName="8OXU73~1.DOC")) returned 1 [0197.185] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a18c970, ftCreationTime.dwHighDateTime=0x1d5d892, ftLastAccessTime.dwLowDateTime=0x76de7c40, ftLastAccessTime.dwHighDateTime=0x1d5e7ca, ftLastWriteTime.dwLowDateTime=0x76de7c40, ftLastWriteTime.dwHighDateTime=0x1d5e7ca, nFileSizeHigh=0x0, nFileSizeLow=0xe6a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="fAtQEuC0.rtf", cAlternateFileName="")) returned 1 [0197.185] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef27a010, ftCreationTime.dwHighDateTime=0x1d5dc7a, ftLastAccessTime.dwLowDateTime=0x3bc337c0, ftLastAccessTime.dwHighDateTime=0x1d5d8fe, ftLastWriteTime.dwLowDateTime=0x3bc337c0, ftLastWriteTime.dwHighDateTime=0x1d5d8fe, nFileSizeHigh=0x0, nFileSizeLow=0x9699, dwReserved0=0x0, dwReserved1=0x0, cFileName="hrDgUoi27hBFkO.ots", cAlternateFileName="HRDGUO~1.OTS")) returned 1 [0197.185] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36194ae0, ftCreationTime.dwHighDateTime=0x1d5e325, ftLastAccessTime.dwLowDateTime=0xd376be90, ftLastAccessTime.dwHighDateTime=0x1d5df50, ftLastWriteTime.dwLowDateTime=0xd376be90, ftLastWriteTime.dwHighDateTime=0x1d5df50, nFileSizeHigh=0x0, nFileSizeLow=0x138d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ixvgGUCVkOM.ods", cAlternateFileName="IXVGGU~1.ODS")) returned 1 [0197.185] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc16e4380, ftCreationTime.dwHighDateTime=0x1d5d8ca, ftLastAccessTime.dwLowDateTime=0xf4e3bc0, ftLastAccessTime.dwHighDateTime=0x1d5e328, ftLastWriteTime.dwLowDateTime=0xf4e3bc0, ftLastWriteTime.dwHighDateTime=0x1d5e328, nFileSizeHigh=0x0, nFileSizeLow=0x1848f, dwReserved0=0x0, dwReserved1=0x0, cFileName="M1e0.ods", cAlternateFileName="")) returned 1 [0197.186] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfda5340, ftCreationTime.dwHighDateTime=0x1d5dbce, ftLastAccessTime.dwLowDateTime=0xf05d1d20, ftLastAccessTime.dwHighDateTime=0x1d5daa9, ftLastWriteTime.dwLowDateTime=0xf05d1d20, ftLastWriteTime.dwHighDateTime=0x1d5daa9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MFZvfNuU_GBRKp", cAlternateFileName="MFZVFN~1")) returned 1 [0197.186] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa44ddf10, ftCreationTime.dwHighDateTime=0x1d5e6ba, ftLastAccessTime.dwLowDateTime=0xea02cde0, ftLastAccessTime.dwHighDateTime=0x1d5deef, ftLastWriteTime.dwLowDateTime=0xea02cde0, ftLastWriteTime.dwHighDateTime=0x1d5deef, nFileSizeHigh=0x0, nFileSizeLow=0x946a, dwReserved0=0x0, dwReserved1=0x0, cFileName="oH_h085FyYS.ods", cAlternateFileName="OH_H08~1.ODS")) returned 1 [0197.186] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5931e340, ftCreationTime.dwHighDateTime=0x1d5e5e9, ftLastAccessTime.dwLowDateTime=0x4c6876a0, ftLastAccessTime.dwHighDateTime=0x1d5d960, ftLastWriteTime.dwLowDateTime=0x4c6876a0, ftLastWriteTime.dwHighDateTime=0x1d5d960, nFileSizeHigh=0x0, nFileSizeLow=0x7f2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PoMJ61slKXzugCu.pdf", cAlternateFileName="POMJ61~1.PDF")) returned 1 [0197.186] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5931e340, ftCreationTime.dwHighDateTime=0x1d5e5e9, ftLastAccessTime.dwLowDateTime=0x4c6876a0, ftLastAccessTime.dwHighDateTime=0x1d5d960, ftLastWriteTime.dwLowDateTime=0x4c6876a0, ftLastWriteTime.dwHighDateTime=0x1d5d960, nFileSizeHigh=0x0, nFileSizeLow=0x7f2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PoMJ61slKXzugCu.pdf", cAlternateFileName="POMJ61~1.PDF")) returned 0 [0197.186] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0197.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df38c) returned 1 [0197.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df398) returned 1 [0197.187] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\MFZvfNuU_GBRKp\\.", nBufferLength=0x105, lpBuffer=0x58dee8c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\MFZvfNuU_GBRKp", lpFilePart=0x0) returned 0x46 [0197.187] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\MFZvfNuU_GBRKp", nBufferLength=0x105, lpBuffer=0x58deec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\MFZvfNuU_GBRKp", lpFilePart=0x0) returned 0x46 [0197.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df31c) returned 1 [0197.187] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\MFZvfNuU_GBRKp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\b80m5n3tef4nk1p\\mfzvfnuu_gbrkp"), fInfoLevelId=0x0, lpFileInformation=0x58df398 | out: lpFileInformation=0x58df398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfda5340, ftCreationTime.dwHighDateTime=0x1d5dbce, ftLastAccessTime.dwLowDateTime=0xf05d1d20, ftLastAccessTime.dwHighDateTime=0x1d5daa9, ftLastWriteTime.dwLowDateTime=0xf05d1d20, ftLastWriteTime.dwHighDateTime=0x1d5daa9, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0197.209] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df318) returned 1 [0197.209] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\MFZvfNuU_GBRKp", nBufferLength=0x105, lpBuffer=0x58deec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\MFZvfNuU_GBRKp", lpFilePart=0x0) returned 0x46 [0197.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df388) returned 1 [0197.209] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\MFZvfNuU_GBRKp", nBufferLength=0x105, lpBuffer=0x58dee90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\MFZvfNuU_GBRKp", lpFilePart=0x0) returned 0x46 [0197.210] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\MFZvfNuU_GBRKp\\", nBufferLength=0x105, lpBuffer=0x58dee64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\MFZvfNuU_GBRKp\\", lpFilePart=0x0) returned 0x47 [0197.210] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\MFZvfNuU_GBRKp\\*", lpFindFileData=0x58df0b0 | out: lpFindFileData=0x58df0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfda5340, ftCreationTime.dwHighDateTime=0x1d5dbce, ftLastAccessTime.dwLowDateTime=0xf05d1d20, ftLastAccessTime.dwHighDateTime=0x1d5daa9, ftLastWriteTime.dwLowDateTime=0xf05d1d20, ftLastWriteTime.dwHighDateTime=0x1d5daa9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0197.222] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfda5340, ftCreationTime.dwHighDateTime=0x1d5dbce, ftLastAccessTime.dwLowDateTime=0xf05d1d20, ftLastAccessTime.dwHighDateTime=0x1d5daa9, ftLastWriteTime.dwLowDateTime=0xf05d1d20, ftLastWriteTime.dwHighDateTime=0x1d5daa9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.223] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf19f3680, ftCreationTime.dwHighDateTime=0x1d5df3d, ftLastAccessTime.dwLowDateTime=0x2747a330, ftLastAccessTime.dwHighDateTime=0x1d5e376, ftLastWriteTime.dwLowDateTime=0x2747a330, ftLastWriteTime.dwHighDateTime=0x1d5e376, nFileSizeHigh=0x0, nFileSizeLow=0x147fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="3VqDm-xXTI_LmxRI56.ppt", cAlternateFileName="3VQDM-~1.PPT")) returned 1 [0197.223] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d380a70, ftCreationTime.dwHighDateTime=0x1d5e4a4, ftLastAccessTime.dwLowDateTime=0xde172990, ftLastAccessTime.dwHighDateTime=0x1d5da26, ftLastWriteTime.dwLowDateTime=0xde172990, ftLastWriteTime.dwHighDateTime=0x1d5da26, nFileSizeHigh=0x0, nFileSizeLow=0xef9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="9L1x9O6sfXTu5PeiPQx.pps", cAlternateFileName="9L1X9O~1.PPS")) returned 1 [0197.223] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9a30d40, ftCreationTime.dwHighDateTime=0x1d5e6fc, ftLastAccessTime.dwLowDateTime=0x21ebabe0, ftLastAccessTime.dwHighDateTime=0x1d5dc5d, ftLastWriteTime.dwLowDateTime=0x21ebabe0, ftLastWriteTime.dwHighDateTime=0x1d5dc5d, nFileSizeHigh=0x0, nFileSizeLow=0x17504, dwReserved0=0x0, dwReserved1=0x0, cFileName="dZatu8X5JR1Nz8GE6t.ppt", cAlternateFileName="DZATU8~1.PPT")) returned 1 [0197.223] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31327a80, ftCreationTime.dwHighDateTime=0x1d5e486, ftLastAccessTime.dwLowDateTime=0x71a0c0, ftLastAccessTime.dwHighDateTime=0x1d5e0ca, ftLastWriteTime.dwLowDateTime=0x71a0c0, ftLastWriteTime.dwHighDateTime=0x1d5e0ca, nFileSizeHigh=0x0, nFileSizeLow=0xed64, dwReserved0=0x0, dwReserved1=0x0, cFileName="OmhDj38iIAkVWQaFj0.xls", cAlternateFileName="OMHDJ3~1.XLS")) returned 1 [0197.223] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x503103a0, ftCreationTime.dwHighDateTime=0x1d5e0f0, ftLastAccessTime.dwLowDateTime=0x10030c50, ftLastAccessTime.dwHighDateTime=0x1d5dd13, ftLastWriteTime.dwLowDateTime=0x10030c50, ftLastWriteTime.dwHighDateTime=0x1d5dd13, nFileSizeHigh=0x0, nFileSizeLow=0x1713c, dwReserved0=0x0, dwReserved1=0x0, cFileName="RRhNxf iyLS.rtf", cAlternateFileName="RRHNXF~1.RTF")) returned 1 [0197.224] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x503103a0, ftCreationTime.dwHighDateTime=0x1d5e0f0, ftLastAccessTime.dwLowDateTime=0x10030c50, ftLastAccessTime.dwHighDateTime=0x1d5dd13, ftLastWriteTime.dwLowDateTime=0x10030c50, ftLastWriteTime.dwHighDateTime=0x1d5dd13, nFileSizeHigh=0x0, nFileSizeLow=0x1713c, dwReserved0=0x0, dwReserved1=0x0, cFileName="RRhNxf iyLS.rtf", cAlternateFileName="RRHNXF~1.RTF")) returned 0 [0197.224] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0197.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df348) returned 1 [0197.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df354) returned 1 [0197.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df388) returned 1 [0197.224] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\MFZvfNuU_GBRKp", nBufferLength=0x105, lpBuffer=0x58dee90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\MFZvfNuU_GBRKp", lpFilePart=0x0) returned 0x46 [0197.225] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\MFZvfNuU_GBRKp\\", nBufferLength=0x105, lpBuffer=0x58dee64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\MFZvfNuU_GBRKp\\", lpFilePart=0x0) returned 0x47 [0197.225] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\MFZvfNuU_GBRKp\\*", lpFindFileData=0x58df0b0 | out: lpFindFileData=0x58df0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfda5340, ftCreationTime.dwHighDateTime=0x1d5dbce, ftLastAccessTime.dwLowDateTime=0xf05d1d20, ftLastAccessTime.dwHighDateTime=0x1d5daa9, ftLastWriteTime.dwLowDateTime=0xf05d1d20, ftLastWriteTime.dwHighDateTime=0x1d5daa9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0197.226] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfda5340, ftCreationTime.dwHighDateTime=0x1d5dbce, ftLastAccessTime.dwLowDateTime=0xf05d1d20, ftLastAccessTime.dwHighDateTime=0x1d5daa9, ftLastWriteTime.dwLowDateTime=0xf05d1d20, ftLastWriteTime.dwHighDateTime=0x1d5daa9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.226] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf19f3680, ftCreationTime.dwHighDateTime=0x1d5df3d, ftLastAccessTime.dwLowDateTime=0x2747a330, ftLastAccessTime.dwHighDateTime=0x1d5e376, ftLastWriteTime.dwLowDateTime=0x2747a330, ftLastWriteTime.dwHighDateTime=0x1d5e376, nFileSizeHigh=0x0, nFileSizeLow=0x147fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="3VqDm-xXTI_LmxRI56.ppt", cAlternateFileName="3VQDM-~1.PPT")) returned 1 [0197.226] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d380a70, ftCreationTime.dwHighDateTime=0x1d5e4a4, ftLastAccessTime.dwLowDateTime=0xde172990, ftLastAccessTime.dwHighDateTime=0x1d5da26, ftLastWriteTime.dwLowDateTime=0xde172990, ftLastWriteTime.dwHighDateTime=0x1d5da26, nFileSizeHigh=0x0, nFileSizeLow=0xef9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="9L1x9O6sfXTu5PeiPQx.pps", cAlternateFileName="9L1X9O~1.PPS")) returned 1 [0197.226] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9a30d40, ftCreationTime.dwHighDateTime=0x1d5e6fc, ftLastAccessTime.dwLowDateTime=0x21ebabe0, ftLastAccessTime.dwHighDateTime=0x1d5dc5d, ftLastWriteTime.dwLowDateTime=0x21ebabe0, ftLastWriteTime.dwHighDateTime=0x1d5dc5d, nFileSizeHigh=0x0, nFileSizeLow=0x17504, dwReserved0=0x0, dwReserved1=0x0, cFileName="dZatu8X5JR1Nz8GE6t.ppt", cAlternateFileName="DZATU8~1.PPT")) returned 1 [0197.226] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31327a80, ftCreationTime.dwHighDateTime=0x1d5e486, ftLastAccessTime.dwLowDateTime=0x71a0c0, ftLastAccessTime.dwHighDateTime=0x1d5e0ca, ftLastWriteTime.dwLowDateTime=0x71a0c0, ftLastWriteTime.dwHighDateTime=0x1d5e0ca, nFileSizeHigh=0x0, nFileSizeLow=0xed64, dwReserved0=0x0, dwReserved1=0x0, cFileName="OmhDj38iIAkVWQaFj0.xls", cAlternateFileName="OMHDJ3~1.XLS")) returned 1 [0197.226] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x503103a0, ftCreationTime.dwHighDateTime=0x1d5e0f0, ftLastAccessTime.dwLowDateTime=0x10030c50, ftLastAccessTime.dwHighDateTime=0x1d5dd13, ftLastWriteTime.dwLowDateTime=0x10030c50, ftLastWriteTime.dwHighDateTime=0x1d5dd13, nFileSizeHigh=0x0, nFileSizeLow=0x1713c, dwReserved0=0x0, dwReserved1=0x0, cFileName="RRhNxf iyLS.rtf", cAlternateFileName="RRHNXF~1.RTF")) returned 1 [0197.226] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0197.227] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0197.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df348) returned 1 [0197.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df354) returned 1 [0197.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3cc) returned 1 [0197.227] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P", nBufferLength=0x105, lpBuffer=0x58deed4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P", lpFilePart=0x0) returned 0x37 [0197.228] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\", nBufferLength=0x105, lpBuffer=0x58deea8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\", lpFilePart=0x0) returned 0x38 [0197.228] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\b80m5N3teF4Nk1P\\*", lpFindFileData=0x58df0f4 | out: lpFindFileData=0x58df0f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddba0680, ftCreationTime.dwHighDateTime=0x1d5e3cb, ftLastAccessTime.dwLowDateTime=0xe835b1c0, ftLastAccessTime.dwHighDateTime=0x1d5e1de, ftLastWriteTime.dwLowDateTime=0xe835b1c0, ftLastWriteTime.dwHighDateTime=0x1d5e1de, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0197.228] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddba0680, ftCreationTime.dwHighDateTime=0x1d5e3cb, ftLastAccessTime.dwLowDateTime=0xe835b1c0, ftLastAccessTime.dwHighDateTime=0x1d5e1de, ftLastWriteTime.dwLowDateTime=0xe835b1c0, ftLastWriteTime.dwHighDateTime=0x1d5e1de, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.228] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bac0e0, ftCreationTime.dwHighDateTime=0x1d5e33a, ftLastAccessTime.dwLowDateTime=0x199c9d90, ftLastAccessTime.dwHighDateTime=0x1d5da79, ftLastWriteTime.dwLowDateTime=0x199c9d90, ftLastWriteTime.dwHighDateTime=0x1d5da79, nFileSizeHigh=0x0, nFileSizeLow=0x16ff3, dwReserved0=0x0, dwReserved1=0x0, cFileName="8oXu73Kth0ycR3.doc", cAlternateFileName="8OXU73~1.DOC")) returned 1 [0197.228] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a18c970, ftCreationTime.dwHighDateTime=0x1d5d892, ftLastAccessTime.dwLowDateTime=0x76de7c40, ftLastAccessTime.dwHighDateTime=0x1d5e7ca, ftLastWriteTime.dwLowDateTime=0x76de7c40, ftLastWriteTime.dwHighDateTime=0x1d5e7ca, nFileSizeHigh=0x0, nFileSizeLow=0xe6a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="fAtQEuC0.rtf", cAlternateFileName="")) returned 1 [0197.228] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef27a010, ftCreationTime.dwHighDateTime=0x1d5dc7a, ftLastAccessTime.dwLowDateTime=0x3bc337c0, ftLastAccessTime.dwHighDateTime=0x1d5d8fe, ftLastWriteTime.dwLowDateTime=0x3bc337c0, ftLastWriteTime.dwHighDateTime=0x1d5d8fe, nFileSizeHigh=0x0, nFileSizeLow=0x9699, dwReserved0=0x0, dwReserved1=0x0, cFileName="hrDgUoi27hBFkO.ots", cAlternateFileName="HRDGUO~1.OTS")) returned 1 [0197.228] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36194ae0, ftCreationTime.dwHighDateTime=0x1d5e325, ftLastAccessTime.dwLowDateTime=0xd376be90, ftLastAccessTime.dwHighDateTime=0x1d5df50, ftLastWriteTime.dwLowDateTime=0xd376be90, ftLastWriteTime.dwHighDateTime=0x1d5df50, nFileSizeHigh=0x0, nFileSizeLow=0x138d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ixvgGUCVkOM.ods", cAlternateFileName="IXVGGU~1.ODS")) returned 1 [0197.228] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc16e4380, ftCreationTime.dwHighDateTime=0x1d5d8ca, ftLastAccessTime.dwLowDateTime=0xf4e3bc0, ftLastAccessTime.dwHighDateTime=0x1d5e328, ftLastWriteTime.dwLowDateTime=0xf4e3bc0, ftLastWriteTime.dwHighDateTime=0x1d5e328, nFileSizeHigh=0x0, nFileSizeLow=0x1848f, dwReserved0=0x0, dwReserved1=0x0, cFileName="M1e0.ods", cAlternateFileName="")) returned 1 [0197.229] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfda5340, ftCreationTime.dwHighDateTime=0x1d5dbce, ftLastAccessTime.dwLowDateTime=0xf05d1d20, ftLastAccessTime.dwHighDateTime=0x1d5daa9, ftLastWriteTime.dwLowDateTime=0xf05d1d20, ftLastWriteTime.dwHighDateTime=0x1d5daa9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MFZvfNuU_GBRKp", cAlternateFileName="MFZVFN~1")) returned 1 [0197.229] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa44ddf10, ftCreationTime.dwHighDateTime=0x1d5e6ba, ftLastAccessTime.dwLowDateTime=0xea02cde0, ftLastAccessTime.dwHighDateTime=0x1d5deef, ftLastWriteTime.dwLowDateTime=0xea02cde0, ftLastWriteTime.dwHighDateTime=0x1d5deef, nFileSizeHigh=0x0, nFileSizeLow=0x946a, dwReserved0=0x0, dwReserved1=0x0, cFileName="oH_h085FyYS.ods", cAlternateFileName="OH_H08~1.ODS")) returned 1 [0197.229] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5931e340, ftCreationTime.dwHighDateTime=0x1d5e5e9, ftLastAccessTime.dwLowDateTime=0x4c6876a0, ftLastAccessTime.dwHighDateTime=0x1d5d960, ftLastWriteTime.dwLowDateTime=0x4c6876a0, ftLastWriteTime.dwHighDateTime=0x1d5d960, nFileSizeHigh=0x0, nFileSizeLow=0x7f2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PoMJ61slKXzugCu.pdf", cAlternateFileName="POMJ61~1.PDF")) returned 1 [0197.230] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0197.230] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0197.230] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df38c) returned 1 [0197.230] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df398) returned 1 [0197.230] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\.", nBufferLength=0x105, lpBuffer=0x58deed0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music", lpFilePart=0x0) returned 0x30 [0197.230] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0x58def04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music", lpFilePart=0x0) returned 0x30 [0197.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df360) returned 1 [0197.230] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my music"), fInfoLevelId=0x0, lpFileInformation=0x58df3dc | out: lpFileInformation=0x58df3dc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0197.230] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df35c) returned 1 [0197.230] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0x58def04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music", lpFilePart=0x0) returned 0x30 [0197.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3cc) returned 1 [0197.231] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0x58deed4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music", lpFilePart=0x0) returned 0x30 [0197.231] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\", nBufferLength=0x105, lpBuffer=0x58deea8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\", lpFilePart=0x0) returned 0x31 [0197.231] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\*", lpFindFileData=0x58df0f4 | out: lpFindFileData=0x58df0f4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0197.231] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df390) returned 1 [0197.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3cc) returned 1 [0197.377] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0x58deed4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music", lpFilePart=0x0) returned 0x30 [0197.377] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\", nBufferLength=0x105, lpBuffer=0x58deea8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\", lpFilePart=0x0) returned 0x31 [0197.378] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\*", lpFindFileData=0x58df0f4 | out: lpFindFileData=0x58df0f4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0197.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df390) returned 1 [0197.380] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\.", nBufferLength=0x105, lpBuffer=0x58deed0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures", lpFilePart=0x0) returned 0x33 [0197.380] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x58def04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures", lpFilePart=0x0) returned 0x33 [0197.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df360) returned 1 [0197.380] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my pictures"), fInfoLevelId=0x0, lpFileInformation=0x58df3dc | out: lpFileInformation=0x58df3dc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0197.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df35c) returned 1 [0197.380] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x58def04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures", lpFilePart=0x0) returned 0x33 [0197.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3cc) returned 1 [0197.381] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x58deed4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures", lpFilePart=0x0) returned 0x33 [0197.381] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\", nBufferLength=0x105, lpBuffer=0x58deea8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\", lpFilePart=0x0) returned 0x34 [0197.381] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\*", lpFindFileData=0x58df0f4 | out: lpFindFileData=0x58df0f4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0197.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df390) returned 1 [0197.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3cc) returned 1 [0197.382] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x58deed4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures", lpFilePart=0x0) returned 0x33 [0197.382] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\", nBufferLength=0x105, lpBuffer=0x58deea8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\", lpFilePart=0x0) returned 0x34 [0197.382] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\*", lpFindFileData=0x58df0f4 | out: lpFindFileData=0x58df0f4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0197.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df390) returned 1 [0197.384] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\.", nBufferLength=0x105, lpBuffer=0x58deed0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes", lpFilePart=0x0) returned 0x31 [0197.384] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes", nBufferLength=0x105, lpBuffer=0x58def04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes", lpFilePart=0x0) returned 0x31 [0197.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df360) returned 1 [0197.384] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes"), fInfoLevelId=0x0, lpFileInformation=0x58df3dc | out: lpFileInformation=0x58df3dc*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0197.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df35c) returned 1 [0197.420] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes", nBufferLength=0x105, lpBuffer=0x58def04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes", lpFilePart=0x0) returned 0x31 [0197.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3cc) returned 1 [0197.420] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes", nBufferLength=0x105, lpBuffer=0x58deed4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes", lpFilePart=0x0) returned 0x31 [0197.420] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\", nBufferLength=0x105, lpBuffer=0x58deea8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\", lpFilePart=0x0) returned 0x32 [0197.420] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\*", lpFindFileData=0x58df0f4 | out: lpFindFileData=0x58df0f4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0197.421] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.421] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0197.421] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9e9e4460, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9e9e4460, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites.vss", cAlternateFileName="FAVORI~1.VSS")) returned 1 [0197.421] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1 [0197.421] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0197.422] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0197.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df38c) returned 1 [0197.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df398) returned 1 [0197.422] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\.", nBufferLength=0x105, lpBuffer=0x58dee8c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private", lpFilePart=0x0) returned 0x3a [0197.422] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private", nBufferLength=0x105, lpBuffer=0x58deec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private", lpFilePart=0x0) returned 0x3a [0197.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df31c) returned 1 [0197.422] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private"), fInfoLevelId=0x0, lpFileInformation=0x58df398 | out: lpFileInformation=0x58df398*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0197.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df318) returned 1 [0197.466] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private", nBufferLength=0x105, lpBuffer=0x58deec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private", lpFilePart=0x0) returned 0x3a [0197.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df388) returned 1 [0197.466] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private", nBufferLength=0x105, lpBuffer=0x58dee90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private", lpFilePart=0x0) returned 0x3a [0197.467] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\", nBufferLength=0x105, lpBuffer=0x58dee64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\", lpFilePart=0x0) returned 0x3b [0197.467] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x58df0b0 | out: lpFindFileData=0x58df0b0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0197.467] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.467] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0197.467] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 0 [0197.467] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0197.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df348) returned 1 [0197.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df354) returned 1 [0197.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df388) returned 1 [0197.468] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private", nBufferLength=0x105, lpBuffer=0x58dee90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private", lpFilePart=0x0) returned 0x3a [0197.468] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\", nBufferLength=0x105, lpBuffer=0x58dee64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\", lpFilePart=0x0) returned 0x3b [0197.468] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x58df0b0 | out: lpFindFileData=0x58df0b0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0197.468] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.468] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0197.468] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0197.468] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0197.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df348) returned 1 [0197.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df354) returned 1 [0197.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3cc) returned 1 [0197.469] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes", nBufferLength=0x105, lpBuffer=0x58deed4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes", lpFilePart=0x0) returned 0x31 [0197.469] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\", nBufferLength=0x105, lpBuffer=0x58deea8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\", lpFilePart=0x0) returned 0x32 [0197.469] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\*", lpFindFileData=0x58df0f4 | out: lpFindFileData=0x58df0f4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0197.469] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.469] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0197.469] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9e9e4460, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9e9e4460, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites.vss", cAlternateFileName="FAVORI~1.VSS")) returned 1 [0197.469] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1 [0197.470] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 0 [0197.470] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0197.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df38c) returned 1 [0197.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df398) returned 1 [0197.470] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\.", nBufferLength=0x105, lpBuffer=0x58deed0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos", lpFilePart=0x0) returned 0x31 [0197.470] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x58def04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos", lpFilePart=0x0) returned 0x31 [0197.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df360) returned 1 [0197.470] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my videos"), fInfoLevelId=0x0, lpFileInformation=0x58df3dc | out: lpFileInformation=0x58df3dc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0197.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df35c) returned 1 [0197.470] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x58def04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos", lpFilePart=0x0) returned 0x31 [0197.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3cc) returned 1 [0197.470] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x58deed4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos", lpFilePart=0x0) returned 0x31 [0197.471] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\", nBufferLength=0x105, lpBuffer=0x58deea8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\", lpFilePart=0x0) returned 0x32 [0197.471] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\*", lpFindFileData=0x58df0f4 | out: lpFindFileData=0x58df0f4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0197.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df390) returned 1 [0197.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3cc) returned 1 [0197.472] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x58deed4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos", lpFilePart=0x0) returned 0x31 [0197.472] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\", nBufferLength=0x105, lpBuffer=0x58deea8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\", lpFilePart=0x0) returned 0x32 [0197.472] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\*", lpFindFileData=0x58df0f4 | out: lpFindFileData=0x58df0f4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0197.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df390) returned 1 [0197.474] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\.", nBufferLength=0x105, lpBuffer=0x58deed0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x35 [0197.474] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x58def04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x35 [0197.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df360) returned 1 [0197.474] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files"), fInfoLevelId=0x0, lpFileInformation=0x58df3dc | out: lpFileInformation=0x58df3dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8a4af3c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8a4af3c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0197.544] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df35c) returned 1 [0197.544] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x58def04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x35 [0197.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3cc) returned 1 [0197.544] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x58deed4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x35 [0197.544] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\", nBufferLength=0x105, lpBuffer=0x58deea8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\", lpFilePart=0x0) returned 0x36 [0197.544] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*", lpFindFileData=0x58df0f4 | out: lpFindFileData=0x58df0f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8a4af3c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8a4af3c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0197.545] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8a4af3c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8a4af3c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.545] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x8a4fb680, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 1 [0197.545] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x8a4fb680, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 0 [0197.545] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0197.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df38c) returned 1 [0197.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df398) returned 1 [0197.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3cc) returned 1 [0197.545] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x58deed4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x35 [0197.545] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\", nBufferLength=0x105, lpBuffer=0x58deea8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\", lpFilePart=0x0) returned 0x36 [0197.545] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*", lpFindFileData=0x58df0f4 | out: lpFindFileData=0x58df0f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8a4af3c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8a4af3c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0197.546] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8a4af3c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8a4af3c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.546] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x8a4fb680, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 1 [0197.546] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0197.546] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0197.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df38c) returned 1 [0197.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df398) returned 1 [0197.546] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\.", nBufferLength=0x105, lpBuffer=0x58deed0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX", lpFilePart=0x0) returned 0x31 [0197.546] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX", nBufferLength=0x105, lpBuffer=0x58def04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX", lpFilePart=0x0) returned 0x31 [0197.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df360) returned 1 [0197.546] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ox2xe8wix"), fInfoLevelId=0x0, lpFileInformation=0x58df3dc | out: lpFileInformation=0x58df3dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedc3a100, ftCreationTime.dwHighDateTime=0x1d5dfa0, ftLastAccessTime.dwLowDateTime=0x63e311d0, ftLastAccessTime.dwHighDateTime=0x1d5db06, ftLastWriteTime.dwLowDateTime=0x63e311d0, ftLastWriteTime.dwHighDateTime=0x1d5db06, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0197.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df35c) returned 1 [0197.575] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX", nBufferLength=0x105, lpBuffer=0x58def04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX", lpFilePart=0x0) returned 0x31 [0197.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3cc) returned 1 [0197.575] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX", nBufferLength=0x105, lpBuffer=0x58deed4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX", lpFilePart=0x0) returned 0x31 [0197.575] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\", nBufferLength=0x105, lpBuffer=0x58deea8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\", lpFilePart=0x0) returned 0x32 [0197.575] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\*", lpFindFileData=0x58df0f4 | out: lpFindFileData=0x58df0f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedc3a100, ftCreationTime.dwHighDateTime=0x1d5dfa0, ftLastAccessTime.dwLowDateTime=0x63e311d0, ftLastAccessTime.dwHighDateTime=0x1d5db06, ftLastWriteTime.dwLowDateTime=0x63e311d0, ftLastWriteTime.dwHighDateTime=0x1d5db06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0197.607] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedc3a100, ftCreationTime.dwHighDateTime=0x1d5dfa0, ftLastAccessTime.dwLowDateTime=0x63e311d0, ftLastAccessTime.dwHighDateTime=0x1d5db06, ftLastWriteTime.dwLowDateTime=0x63e311d0, ftLastWriteTime.dwHighDateTime=0x1d5db06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.607] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0121890, ftCreationTime.dwHighDateTime=0x1d5dec8, ftLastAccessTime.dwLowDateTime=0x92268860, ftLastAccessTime.dwHighDateTime=0x1d5e097, ftLastWriteTime.dwLowDateTime=0x92268860, ftLastWriteTime.dwHighDateTime=0x1d5e097, nFileSizeHigh=0x0, nFileSizeLow=0x70dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="eZ8F1rLnNZkF6PBD.pdf", cAlternateFileName="EZ8F1R~1.PDF")) returned 1 [0197.607] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb54e7250, ftCreationTime.dwHighDateTime=0x1d5e153, ftLastAccessTime.dwLowDateTime=0xf3912510, ftLastAccessTime.dwHighDateTime=0x1d5e0f6, ftLastWriteTime.dwLowDateTime=0xf3912510, ftLastWriteTime.dwHighDateTime=0x1d5e0f6, nFileSizeHigh=0x0, nFileSizeLow=0x2d32, dwReserved0=0x0, dwReserved1=0x0, cFileName="HbK2eYeZ0jl.ots", cAlternateFileName="HBK2EY~1.OTS")) returned 1 [0197.607] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18e8d910, ftCreationTime.dwHighDateTime=0x1d5db99, ftLastAccessTime.dwLowDateTime=0xca00b4c0, ftLastAccessTime.dwHighDateTime=0x1d5dc61, ftLastWriteTime.dwLowDateTime=0xca00b4c0, ftLastWriteTime.dwHighDateTime=0x1d5dc61, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kBB9 -d3qzol", cAlternateFileName="KBB9-D~1")) returned 1 [0197.607] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22768d40, ftCreationTime.dwHighDateTime=0x1d5dadd, ftLastAccessTime.dwLowDateTime=0x2d5e6da0, ftLastAccessTime.dwHighDateTime=0x1d5d889, ftLastWriteTime.dwLowDateTime=0x2d5e6da0, ftLastWriteTime.dwHighDateTime=0x1d5d889, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pofeVTrQS", cAlternateFileName="POFEVT~1")) returned 1 [0197.607] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7137b40, ftCreationTime.dwHighDateTime=0x1d5df7a, ftLastAccessTime.dwLowDateTime=0xf39a71e0, ftLastAccessTime.dwHighDateTime=0x1d5dc2a, ftLastWriteTime.dwLowDateTime=0xf39a71e0, ftLastWriteTime.dwHighDateTime=0x1d5dc2a, nFileSizeHigh=0x0, nFileSizeLow=0x18829, dwReserved0=0x0, dwReserved1=0x0, cFileName="u4Np4KbgMI.ots", cAlternateFileName="U4NP4K~1.OTS")) returned 1 [0197.608] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7137b40, ftCreationTime.dwHighDateTime=0x1d5df7a, ftLastAccessTime.dwLowDateTime=0xf39a71e0, ftLastAccessTime.dwHighDateTime=0x1d5dc2a, ftLastWriteTime.dwLowDateTime=0xf39a71e0, ftLastWriteTime.dwHighDateTime=0x1d5dc2a, nFileSizeHigh=0x0, nFileSizeLow=0x18829, dwReserved0=0x0, dwReserved1=0x0, cFileName="u4Np4KbgMI.ots", cAlternateFileName="U4NP4K~1.OTS")) returned 0 [0197.608] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0197.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df38c) returned 1 [0197.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df398) returned 1 [0197.609] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\kBB9 -d3qzol\\.", nBufferLength=0x105, lpBuffer=0x58dee8c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\kBB9 -d3qzol", lpFilePart=0x0) returned 0x3e [0197.609] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\kBB9 -d3qzol", nBufferLength=0x105, lpBuffer=0x58deec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\kBB9 -d3qzol", lpFilePart=0x0) returned 0x3e [0197.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df31c) returned 1 [0197.609] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\kBB9 -d3qzol" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ox2xe8wix\\kbb9 -d3qzol"), fInfoLevelId=0x0, lpFileInformation=0x58df398 | out: lpFileInformation=0x58df398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18e8d910, ftCreationTime.dwHighDateTime=0x1d5db99, ftLastAccessTime.dwLowDateTime=0xca00b4c0, ftLastAccessTime.dwHighDateTime=0x1d5dc61, ftLastWriteTime.dwLowDateTime=0xca00b4c0, ftLastWriteTime.dwHighDateTime=0x1d5dc61, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0197.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df318) returned 1 [0197.643] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\kBB9 -d3qzol", nBufferLength=0x105, lpBuffer=0x58deec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\kBB9 -d3qzol", lpFilePart=0x0) returned 0x3e [0197.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df388) returned 1 [0197.643] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\kBB9 -d3qzol", nBufferLength=0x105, lpBuffer=0x58dee90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\kBB9 -d3qzol", lpFilePart=0x0) returned 0x3e [0197.643] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\kBB9 -d3qzol\\", nBufferLength=0x105, lpBuffer=0x58dee64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\kBB9 -d3qzol\\", lpFilePart=0x0) returned 0x3f [0197.643] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\kBB9 -d3qzol\\*", lpFindFileData=0x58df0b0 | out: lpFindFileData=0x58df0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18e8d910, ftCreationTime.dwHighDateTime=0x1d5db99, ftLastAccessTime.dwLowDateTime=0xca00b4c0, ftLastAccessTime.dwHighDateTime=0x1d5dc61, ftLastWriteTime.dwLowDateTime=0xca00b4c0, ftLastWriteTime.dwHighDateTime=0x1d5dc61, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0197.643] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18e8d910, ftCreationTime.dwHighDateTime=0x1d5db99, ftLastAccessTime.dwLowDateTime=0xca00b4c0, ftLastAccessTime.dwHighDateTime=0x1d5dc61, ftLastWriteTime.dwLowDateTime=0xca00b4c0, ftLastWriteTime.dwHighDateTime=0x1d5dc61, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.643] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3443440, ftCreationTime.dwHighDateTime=0x1d5dd17, ftLastAccessTime.dwLowDateTime=0x576db870, ftLastAccessTime.dwHighDateTime=0x1d5e1e0, ftLastWriteTime.dwLowDateTime=0x576db870, ftLastWriteTime.dwHighDateTime=0x1d5e1e0, nFileSizeHigh=0x0, nFileSizeLow=0x50b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="8-4fw.odp", cAlternateFileName="")) returned 1 [0197.644] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa71ba0a0, ftCreationTime.dwHighDateTime=0x1d5e00d, ftLastAccessTime.dwLowDateTime=0xab5fecd0, ftLastAccessTime.dwHighDateTime=0x1d5e66a, ftLastWriteTime.dwLowDateTime=0xab5fecd0, ftLastWriteTime.dwHighDateTime=0x1d5e66a, nFileSizeHigh=0x0, nFileSizeLow=0x9e7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="8by49RPV-VLLM6I8G6l.pps", cAlternateFileName="8BY49R~1.PPS")) returned 1 [0197.644] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa71ba0a0, ftCreationTime.dwHighDateTime=0x1d5e00d, ftLastAccessTime.dwLowDateTime=0xab5fecd0, ftLastAccessTime.dwHighDateTime=0x1d5e66a, ftLastWriteTime.dwLowDateTime=0xab5fecd0, ftLastWriteTime.dwHighDateTime=0x1d5e66a, nFileSizeHigh=0x0, nFileSizeLow=0x9e7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="8by49RPV-VLLM6I8G6l.pps", cAlternateFileName="8BY49R~1.PPS")) returned 0 [0197.644] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0197.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df348) returned 1 [0197.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df354) returned 1 [0197.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df388) returned 1 [0197.644] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\kBB9 -d3qzol", nBufferLength=0x105, lpBuffer=0x58dee90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\kBB9 -d3qzol", lpFilePart=0x0) returned 0x3e [0197.644] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\kBB9 -d3qzol\\", nBufferLength=0x105, lpBuffer=0x58dee64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\kBB9 -d3qzol\\", lpFilePart=0x0) returned 0x3f [0197.645] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\kBB9 -d3qzol\\*", lpFindFileData=0x58df0b0 | out: lpFindFileData=0x58df0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18e8d910, ftCreationTime.dwHighDateTime=0x1d5db99, ftLastAccessTime.dwLowDateTime=0xca00b4c0, ftLastAccessTime.dwHighDateTime=0x1d5dc61, ftLastWriteTime.dwLowDateTime=0xca00b4c0, ftLastWriteTime.dwHighDateTime=0x1d5dc61, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0197.645] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18e8d910, ftCreationTime.dwHighDateTime=0x1d5db99, ftLastAccessTime.dwLowDateTime=0xca00b4c0, ftLastAccessTime.dwHighDateTime=0x1d5dc61, ftLastWriteTime.dwLowDateTime=0xca00b4c0, ftLastWriteTime.dwHighDateTime=0x1d5dc61, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.645] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3443440, ftCreationTime.dwHighDateTime=0x1d5dd17, ftLastAccessTime.dwLowDateTime=0x576db870, ftLastAccessTime.dwHighDateTime=0x1d5e1e0, ftLastWriteTime.dwLowDateTime=0x576db870, ftLastWriteTime.dwHighDateTime=0x1d5e1e0, nFileSizeHigh=0x0, nFileSizeLow=0x50b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="8-4fw.odp", cAlternateFileName="")) returned 1 [0197.645] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa71ba0a0, ftCreationTime.dwHighDateTime=0x1d5e00d, ftLastAccessTime.dwLowDateTime=0xab5fecd0, ftLastAccessTime.dwHighDateTime=0x1d5e66a, ftLastWriteTime.dwLowDateTime=0xab5fecd0, ftLastWriteTime.dwHighDateTime=0x1d5e66a, nFileSizeHigh=0x0, nFileSizeLow=0x9e7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="8by49RPV-VLLM6I8G6l.pps", cAlternateFileName="8BY49R~1.PPS")) returned 1 [0197.646] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0197.646] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0197.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df348) returned 1 [0197.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df354) returned 1 [0197.646] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\pofeVTrQS\\.", nBufferLength=0x105, lpBuffer=0x58dee8c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\pofeVTrQS", lpFilePart=0x0) returned 0x3b [0197.646] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\pofeVTrQS", nBufferLength=0x105, lpBuffer=0x58deec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\pofeVTrQS", lpFilePart=0x0) returned 0x3b [0197.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df31c) returned 1 [0197.646] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\pofeVTrQS" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ox2xe8wix\\pofevtrqs"), fInfoLevelId=0x0, lpFileInformation=0x58df398 | out: lpFileInformation=0x58df398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22768d40, ftCreationTime.dwHighDateTime=0x1d5dadd, ftLastAccessTime.dwLowDateTime=0x2d5e6da0, ftLastAccessTime.dwHighDateTime=0x1d5d889, ftLastWriteTime.dwLowDateTime=0x2d5e6da0, ftLastWriteTime.dwHighDateTime=0x1d5d889, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0197.852] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df318) returned 1 [0197.852] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\pofeVTrQS", nBufferLength=0x105, lpBuffer=0x58deec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\pofeVTrQS", lpFilePart=0x0) returned 0x3b [0197.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df388) returned 1 [0197.853] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\pofeVTrQS", nBufferLength=0x105, lpBuffer=0x58dee90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\pofeVTrQS", lpFilePart=0x0) returned 0x3b [0197.853] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\pofeVTrQS\\", nBufferLength=0x105, lpBuffer=0x58dee64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\pofeVTrQS\\", lpFilePart=0x0) returned 0x3c [0197.853] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\pofeVTrQS\\*", lpFindFileData=0x58df0b0 | out: lpFindFileData=0x58df0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22768d40, ftCreationTime.dwHighDateTime=0x1d5dadd, ftLastAccessTime.dwLowDateTime=0x2d5e6da0, ftLastAccessTime.dwHighDateTime=0x1d5d889, ftLastWriteTime.dwLowDateTime=0x2d5e6da0, ftLastWriteTime.dwHighDateTime=0x1d5d889, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0197.854] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22768d40, ftCreationTime.dwHighDateTime=0x1d5dadd, ftLastAccessTime.dwLowDateTime=0x2d5e6da0, ftLastAccessTime.dwHighDateTime=0x1d5d889, ftLastWriteTime.dwLowDateTime=0x2d5e6da0, ftLastWriteTime.dwHighDateTime=0x1d5d889, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.855] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54d38040, ftCreationTime.dwHighDateTime=0x1d5dc27, ftLastAccessTime.dwLowDateTime=0x4822c530, ftLastAccessTime.dwHighDateTime=0x1d5e56a, ftLastWriteTime.dwLowDateTime=0x4822c530, ftLastWriteTime.dwHighDateTime=0x1d5e56a, nFileSizeHigh=0x0, nFileSizeLow=0x9314, dwReserved0=0x0, dwReserved1=0x0, cFileName="jA5n3bQ y.odt", cAlternateFileName="JA5N3B~1.ODT")) returned 1 [0197.855] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae07450, ftCreationTime.dwHighDateTime=0x1d5e47b, ftLastAccessTime.dwLowDateTime=0x5e6d6cd0, ftLastAccessTime.dwHighDateTime=0x1d5e558, ftLastWriteTime.dwLowDateTime=0x5e6d6cd0, ftLastWriteTime.dwHighDateTime=0x1d5e558, nFileSizeHigh=0x0, nFileSizeLow=0x5c64, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZtGNUjd.rtf", cAlternateFileName="")) returned 1 [0197.856] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae07450, ftCreationTime.dwHighDateTime=0x1d5e47b, ftLastAccessTime.dwLowDateTime=0x5e6d6cd0, ftLastAccessTime.dwHighDateTime=0x1d5e558, ftLastWriteTime.dwLowDateTime=0x5e6d6cd0, ftLastWriteTime.dwHighDateTime=0x1d5e558, nFileSizeHigh=0x0, nFileSizeLow=0x5c64, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZtGNUjd.rtf", cAlternateFileName="")) returned 0 [0197.856] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0197.856] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df348) returned 1 [0197.856] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df354) returned 1 [0197.856] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df388) returned 1 [0197.856] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\pofeVTrQS", nBufferLength=0x105, lpBuffer=0x58dee90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\pofeVTrQS", lpFilePart=0x0) returned 0x3b [0197.856] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\pofeVTrQS\\", nBufferLength=0x105, lpBuffer=0x58dee64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\pofeVTrQS\\", lpFilePart=0x0) returned 0x3c [0197.856] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\pofeVTrQS\\*", lpFindFileData=0x58df0b0 | out: lpFindFileData=0x58df0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22768d40, ftCreationTime.dwHighDateTime=0x1d5dadd, ftLastAccessTime.dwLowDateTime=0x2d5e6da0, ftLastAccessTime.dwHighDateTime=0x1d5d889, ftLastWriteTime.dwLowDateTime=0x2d5e6da0, ftLastWriteTime.dwHighDateTime=0x1d5d889, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0197.856] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22768d40, ftCreationTime.dwHighDateTime=0x1d5dadd, ftLastAccessTime.dwLowDateTime=0x2d5e6da0, ftLastAccessTime.dwHighDateTime=0x1d5d889, ftLastWriteTime.dwLowDateTime=0x2d5e6da0, ftLastWriteTime.dwHighDateTime=0x1d5d889, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.857] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54d38040, ftCreationTime.dwHighDateTime=0x1d5dc27, ftLastAccessTime.dwLowDateTime=0x4822c530, ftLastAccessTime.dwHighDateTime=0x1d5e56a, ftLastWriteTime.dwLowDateTime=0x4822c530, ftLastWriteTime.dwHighDateTime=0x1d5e56a, nFileSizeHigh=0x0, nFileSizeLow=0x9314, dwReserved0=0x0, dwReserved1=0x0, cFileName="jA5n3bQ y.odt", cAlternateFileName="JA5N3B~1.ODT")) returned 1 [0197.857] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae07450, ftCreationTime.dwHighDateTime=0x1d5e47b, ftLastAccessTime.dwLowDateTime=0x5e6d6cd0, ftLastAccessTime.dwHighDateTime=0x1d5e558, ftLastWriteTime.dwLowDateTime=0x5e6d6cd0, ftLastWriteTime.dwHighDateTime=0x1d5e558, nFileSizeHigh=0x0, nFileSizeLow=0x5c64, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZtGNUjd.rtf", cAlternateFileName="")) returned 1 [0197.857] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0197.857] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0197.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df348) returned 1 [0197.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df354) returned 1 [0197.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3cc) returned 1 [0197.857] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX", nBufferLength=0x105, lpBuffer=0x58deed4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX", lpFilePart=0x0) returned 0x31 [0197.857] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\", nBufferLength=0x105, lpBuffer=0x58deea8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\", lpFilePart=0x0) returned 0x32 [0197.857] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oX2xE8wIX\\*", lpFindFileData=0x58df0f4 | out: lpFindFileData=0x58df0f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedc3a100, ftCreationTime.dwHighDateTime=0x1d5dfa0, ftLastAccessTime.dwLowDateTime=0x63e311d0, ftLastAccessTime.dwHighDateTime=0x1d5db06, ftLastWriteTime.dwLowDateTime=0x63e311d0, ftLastWriteTime.dwHighDateTime=0x1d5db06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0197.858] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedc3a100, ftCreationTime.dwHighDateTime=0x1d5dfa0, ftLastAccessTime.dwLowDateTime=0x63e311d0, ftLastAccessTime.dwHighDateTime=0x1d5db06, ftLastWriteTime.dwLowDateTime=0x63e311d0, ftLastWriteTime.dwHighDateTime=0x1d5db06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.858] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0121890, ftCreationTime.dwHighDateTime=0x1d5dec8, ftLastAccessTime.dwLowDateTime=0x92268860, ftLastAccessTime.dwHighDateTime=0x1d5e097, ftLastWriteTime.dwLowDateTime=0x92268860, ftLastWriteTime.dwHighDateTime=0x1d5e097, nFileSizeHigh=0x0, nFileSizeLow=0x70dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="eZ8F1rLnNZkF6PBD.pdf", cAlternateFileName="EZ8F1R~1.PDF")) returned 1 [0197.858] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb54e7250, ftCreationTime.dwHighDateTime=0x1d5e153, ftLastAccessTime.dwLowDateTime=0xf3912510, ftLastAccessTime.dwHighDateTime=0x1d5e0f6, ftLastWriteTime.dwLowDateTime=0xf3912510, ftLastWriteTime.dwHighDateTime=0x1d5e0f6, nFileSizeHigh=0x0, nFileSizeLow=0x2d32, dwReserved0=0x0, dwReserved1=0x0, cFileName="HbK2eYeZ0jl.ots", cAlternateFileName="HBK2EY~1.OTS")) returned 1 [0197.858] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18e8d910, ftCreationTime.dwHighDateTime=0x1d5db99, ftLastAccessTime.dwLowDateTime=0xca00b4c0, ftLastAccessTime.dwHighDateTime=0x1d5dc61, ftLastWriteTime.dwLowDateTime=0xca00b4c0, ftLastWriteTime.dwHighDateTime=0x1d5dc61, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kBB9 -d3qzol", cAlternateFileName="KBB9-D~1")) returned 1 [0197.858] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22768d40, ftCreationTime.dwHighDateTime=0x1d5dadd, ftLastAccessTime.dwLowDateTime=0x2d5e6da0, ftLastAccessTime.dwHighDateTime=0x1d5d889, ftLastWriteTime.dwLowDateTime=0x2d5e6da0, ftLastWriteTime.dwHighDateTime=0x1d5d889, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pofeVTrQS", cAlternateFileName="POFEVT~1")) returned 1 [0197.858] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7137b40, ftCreationTime.dwHighDateTime=0x1d5df7a, ftLastAccessTime.dwLowDateTime=0xf39a71e0, ftLastAccessTime.dwHighDateTime=0x1d5dc2a, ftLastWriteTime.dwLowDateTime=0xf39a71e0, ftLastWriteTime.dwHighDateTime=0x1d5dc2a, nFileSizeHigh=0x0, nFileSizeLow=0x18829, dwReserved0=0x0, dwReserved1=0x0, cFileName="u4Np4KbgMI.ots", cAlternateFileName="U4NP4K~1.OTS")) returned 1 [0197.858] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0197.859] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0197.859] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df38c) returned 1 [0197.859] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df398) returned 1 [0197.859] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QmUng5_ZXRVu\\.", nBufferLength=0x105, lpBuffer=0x58deed0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QmUng5_ZXRVu", lpFilePart=0x0) returned 0x34 [0197.859] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QmUng5_ZXRVu", nBufferLength=0x105, lpBuffer=0x58def04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QmUng5_ZXRVu", lpFilePart=0x0) returned 0x34 [0197.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df360) returned 1 [0197.859] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QmUng5_ZXRVu" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qmung5_zxrvu"), fInfoLevelId=0x0, lpFileInformation=0x58df3dc | out: lpFileInformation=0x58df3dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a2ea540, ftCreationTime.dwHighDateTime=0x1d5da48, ftLastAccessTime.dwLowDateTime=0x52cdcad0, ftLastAccessTime.dwHighDateTime=0x1d5db9b, ftLastWriteTime.dwLowDateTime=0x52cdcad0, ftLastWriteTime.dwHighDateTime=0x1d5db9b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0197.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df35c) returned 1 [0197.873] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QmUng5_ZXRVu", nBufferLength=0x105, lpBuffer=0x58def04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QmUng5_ZXRVu", lpFilePart=0x0) returned 0x34 [0197.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3cc) returned 1 [0197.873] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QmUng5_ZXRVu", nBufferLength=0x105, lpBuffer=0x58deed4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QmUng5_ZXRVu", lpFilePart=0x0) returned 0x34 [0197.874] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QmUng5_ZXRVu\\", nBufferLength=0x105, lpBuffer=0x58deea8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QmUng5_ZXRVu\\", lpFilePart=0x0) returned 0x35 [0197.874] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QmUng5_ZXRVu\\*", lpFindFileData=0x58df0f4 | out: lpFindFileData=0x58df0f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a2ea540, ftCreationTime.dwHighDateTime=0x1d5da48, ftLastAccessTime.dwLowDateTime=0x52cdcad0, ftLastAccessTime.dwHighDateTime=0x1d5db9b, ftLastWriteTime.dwLowDateTime=0x52cdcad0, ftLastWriteTime.dwHighDateTime=0x1d5db9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0197.880] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a2ea540, ftCreationTime.dwHighDateTime=0x1d5da48, ftLastAccessTime.dwLowDateTime=0x52cdcad0, ftLastAccessTime.dwHighDateTime=0x1d5db9b, ftLastWriteTime.dwLowDateTime=0x52cdcad0, ftLastWriteTime.dwHighDateTime=0x1d5db9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.880] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b9c21e0, ftCreationTime.dwHighDateTime=0x1d5dd84, ftLastAccessTime.dwLowDateTime=0x30e66b40, ftLastAccessTime.dwHighDateTime=0x1d5e1f2, ftLastWriteTime.dwLowDateTime=0x30e66b40, ftLastWriteTime.dwHighDateTime=0x1d5e1f2, nFileSizeHigh=0x0, nFileSizeLow=0x144df, dwReserved0=0x0, dwReserved1=0x0, cFileName="eLG g.csv", cAlternateFileName="ELGG~1.CSV")) returned 1 [0197.880] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9c986e0, ftCreationTime.dwHighDateTime=0x1d5da11, ftLastAccessTime.dwLowDateTime=0xbd824a50, ftLastAccessTime.dwHighDateTime=0x1d5d9dd, ftLastWriteTime.dwLowDateTime=0xbd824a50, ftLastWriteTime.dwHighDateTime=0x1d5d9dd, nFileSizeHigh=0x0, nFileSizeLow=0xc432, dwReserved0=0x0, dwReserved1=0x0, cFileName="JbAihv8NrCGcTNBQ.docx", cAlternateFileName="JBAIHV~1.DOC")) returned 1 [0197.880] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c0474e0, ftCreationTime.dwHighDateTime=0x1d5e3d2, ftLastAccessTime.dwLowDateTime=0x4993de30, ftLastAccessTime.dwHighDateTime=0x1d5e2f5, ftLastWriteTime.dwLowDateTime=0x4993de30, ftLastWriteTime.dwHighDateTime=0x1d5e2f5, nFileSizeHigh=0x0, nFileSizeLow=0x148b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Jg4DO.odp", cAlternateFileName="")) returned 1 [0197.880] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd998f50, ftCreationTime.dwHighDateTime=0x1d5db03, ftLastAccessTime.dwLowDateTime=0xbe377500, ftLastAccessTime.dwHighDateTime=0x1d5e1ea, ftLastWriteTime.dwLowDateTime=0xbe377500, ftLastWriteTime.dwHighDateTime=0x1d5e1ea, nFileSizeHigh=0x0, nFileSizeLow=0x13661, dwReserved0=0x0, dwReserved1=0x0, cFileName="puw07N7wzlsssBxsxS6.odp", cAlternateFileName="PUW07N~1.ODP")) returned 1 [0197.880] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d5527b0, ftCreationTime.dwHighDateTime=0x1d5e60a, ftLastAccessTime.dwLowDateTime=0x5df22e10, ftLastAccessTime.dwHighDateTime=0x1d5e573, ftLastWriteTime.dwLowDateTime=0x5df22e10, ftLastWriteTime.dwHighDateTime=0x1d5e573, nFileSizeHigh=0x0, nFileSizeLow=0x1c28, dwReserved0=0x0, dwReserved1=0x0, cFileName="QX1JIeX776Md8_Ud3.odp", cAlternateFileName="QX1JIE~1.ODP")) returned 1 [0197.881] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70615930, ftCreationTime.dwHighDateTime=0x1d5dfcf, ftLastAccessTime.dwLowDateTime=0xedbb2b80, ftLastAccessTime.dwHighDateTime=0x1d5e390, ftLastWriteTime.dwLowDateTime=0xedbb2b80, ftLastWriteTime.dwHighDateTime=0x1d5e390, nFileSizeHigh=0x0, nFileSizeLow=0x1305f, dwReserved0=0x0, dwReserved1=0x0, cFileName="r5AONVBn.csv", cAlternateFileName="")) returned 1 [0197.881] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd203a7f0, ftCreationTime.dwHighDateTime=0x1d5e6e2, ftLastAccessTime.dwLowDateTime=0x4fee38a0, ftLastAccessTime.dwHighDateTime=0x1d5dbea, ftLastWriteTime.dwLowDateTime=0x4fee38a0, ftLastWriteTime.dwHighDateTime=0x1d5dbea, nFileSizeHigh=0x0, nFileSizeLow=0x170c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="ScSDD9lkRvZQeGQebi.ots", cAlternateFileName="SCSDD9~1.OTS")) returned 1 [0197.881] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac3bfe50, ftCreationTime.dwHighDateTime=0x1d5d7ab, ftLastAccessTime.dwLowDateTime=0x30b6b1d0, ftLastAccessTime.dwHighDateTime=0x1d5e007, ftLastWriteTime.dwLowDateTime=0x30b6b1d0, ftLastWriteTime.dwHighDateTime=0x1d5e007, nFileSizeHigh=0x0, nFileSizeLow=0x8ff6, dwReserved0=0x0, dwReserved1=0x0, cFileName="vTmvP4H8a3D.odt", cAlternateFileName="VTMVP4~1.ODT")) returned 1 [0197.881] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac3bfe50, ftCreationTime.dwHighDateTime=0x1d5d7ab, ftLastAccessTime.dwLowDateTime=0x30b6b1d0, ftLastAccessTime.dwHighDateTime=0x1d5e007, ftLastWriteTime.dwLowDateTime=0x30b6b1d0, ftLastWriteTime.dwHighDateTime=0x1d5e007, nFileSizeHigh=0x0, nFileSizeLow=0x8ff6, dwReserved0=0x0, dwReserved1=0x0, cFileName="vTmvP4H8a3D.odt", cAlternateFileName="VTMVP4~1.ODT")) returned 0 [0197.881] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0197.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df38c) returned 1 [0197.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df398) returned 1 [0197.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3cc) returned 1 [0197.882] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QmUng5_ZXRVu", nBufferLength=0x105, lpBuffer=0x58deed4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QmUng5_ZXRVu", lpFilePart=0x0) returned 0x34 [0197.882] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QmUng5_ZXRVu\\", nBufferLength=0x105, lpBuffer=0x58deea8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QmUng5_ZXRVu\\", lpFilePart=0x0) returned 0x35 [0197.882] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QmUng5_ZXRVu\\*", lpFindFileData=0x58df0f4 | out: lpFindFileData=0x58df0f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a2ea540, ftCreationTime.dwHighDateTime=0x1d5da48, ftLastAccessTime.dwLowDateTime=0x52cdcad0, ftLastAccessTime.dwHighDateTime=0x1d5db9b, ftLastWriteTime.dwLowDateTime=0x52cdcad0, ftLastWriteTime.dwHighDateTime=0x1d5db9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0197.883] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a2ea540, ftCreationTime.dwHighDateTime=0x1d5da48, ftLastAccessTime.dwLowDateTime=0x52cdcad0, ftLastAccessTime.dwHighDateTime=0x1d5db9b, ftLastWriteTime.dwLowDateTime=0x52cdcad0, ftLastWriteTime.dwHighDateTime=0x1d5db9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.883] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b9c21e0, ftCreationTime.dwHighDateTime=0x1d5dd84, ftLastAccessTime.dwLowDateTime=0x30e66b40, ftLastAccessTime.dwHighDateTime=0x1d5e1f2, ftLastWriteTime.dwLowDateTime=0x30e66b40, ftLastWriteTime.dwHighDateTime=0x1d5e1f2, nFileSizeHigh=0x0, nFileSizeLow=0x144df, dwReserved0=0x0, dwReserved1=0x0, cFileName="eLG g.csv", cAlternateFileName="ELGG~1.CSV")) returned 1 [0197.883] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9c986e0, ftCreationTime.dwHighDateTime=0x1d5da11, ftLastAccessTime.dwLowDateTime=0xbd824a50, ftLastAccessTime.dwHighDateTime=0x1d5d9dd, ftLastWriteTime.dwLowDateTime=0xbd824a50, ftLastWriteTime.dwHighDateTime=0x1d5d9dd, nFileSizeHigh=0x0, nFileSizeLow=0xc432, dwReserved0=0x0, dwReserved1=0x0, cFileName="JbAihv8NrCGcTNBQ.docx", cAlternateFileName="JBAIHV~1.DOC")) returned 1 [0197.884] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c0474e0, ftCreationTime.dwHighDateTime=0x1d5e3d2, ftLastAccessTime.dwLowDateTime=0x4993de30, ftLastAccessTime.dwHighDateTime=0x1d5e2f5, ftLastWriteTime.dwLowDateTime=0x4993de30, ftLastWriteTime.dwHighDateTime=0x1d5e2f5, nFileSizeHigh=0x0, nFileSizeLow=0x148b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Jg4DO.odp", cAlternateFileName="")) returned 1 [0197.884] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd998f50, ftCreationTime.dwHighDateTime=0x1d5db03, ftLastAccessTime.dwLowDateTime=0xbe377500, ftLastAccessTime.dwHighDateTime=0x1d5e1ea, ftLastWriteTime.dwLowDateTime=0xbe377500, ftLastWriteTime.dwHighDateTime=0x1d5e1ea, nFileSizeHigh=0x0, nFileSizeLow=0x13661, dwReserved0=0x0, dwReserved1=0x0, cFileName="puw07N7wzlsssBxsxS6.odp", cAlternateFileName="PUW07N~1.ODP")) returned 1 [0197.884] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d5527b0, ftCreationTime.dwHighDateTime=0x1d5e60a, ftLastAccessTime.dwLowDateTime=0x5df22e10, ftLastAccessTime.dwHighDateTime=0x1d5e573, ftLastWriteTime.dwLowDateTime=0x5df22e10, ftLastWriteTime.dwHighDateTime=0x1d5e573, nFileSizeHigh=0x0, nFileSizeLow=0x1c28, dwReserved0=0x0, dwReserved1=0x0, cFileName="QX1JIeX776Md8_Ud3.odp", cAlternateFileName="QX1JIE~1.ODP")) returned 1 [0197.884] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70615930, ftCreationTime.dwHighDateTime=0x1d5dfcf, ftLastAccessTime.dwLowDateTime=0xedbb2b80, ftLastAccessTime.dwHighDateTime=0x1d5e390, ftLastWriteTime.dwLowDateTime=0xedbb2b80, ftLastWriteTime.dwHighDateTime=0x1d5e390, nFileSizeHigh=0x0, nFileSizeLow=0x1305f, dwReserved0=0x0, dwReserved1=0x0, cFileName="r5AONVBn.csv", cAlternateFileName="")) returned 1 [0197.884] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd203a7f0, ftCreationTime.dwHighDateTime=0x1d5e6e2, ftLastAccessTime.dwLowDateTime=0x4fee38a0, ftLastAccessTime.dwHighDateTime=0x1d5dbea, ftLastWriteTime.dwLowDateTime=0x4fee38a0, ftLastWriteTime.dwHighDateTime=0x1d5dbea, nFileSizeHigh=0x0, nFileSizeLow=0x170c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="ScSDD9lkRvZQeGQebi.ots", cAlternateFileName="SCSDD9~1.OTS")) returned 1 [0197.884] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac3bfe50, ftCreationTime.dwHighDateTime=0x1d5d7ab, ftLastAccessTime.dwLowDateTime=0x30b6b1d0, ftLastAccessTime.dwHighDateTime=0x1d5e007, ftLastWriteTime.dwLowDateTime=0x30b6b1d0, ftLastWriteTime.dwHighDateTime=0x1d5e007, nFileSizeHigh=0x0, nFileSizeLow=0x8ff6, dwReserved0=0x0, dwReserved1=0x0, cFileName="vTmvP4H8a3D.odt", cAlternateFileName="VTMVP4~1.ODT")) returned 1 [0197.884] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0197.884] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0197.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df38c) returned 1 [0197.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df398) returned 1 [0197.885] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rIREdumyZRX80jt2\\.", nBufferLength=0x105, lpBuffer=0x58deed0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rIREdumyZRX80jt2", lpFilePart=0x0) returned 0x38 [0197.886] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rIREdumyZRX80jt2", nBufferLength=0x105, lpBuffer=0x58def04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rIREdumyZRX80jt2", lpFilePart=0x0) returned 0x38 [0197.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df360) returned 1 [0197.886] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rIREdumyZRX80jt2" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\riredumyzrx80jt2"), fInfoLevelId=0x0, lpFileInformation=0x58df3dc | out: lpFileInformation=0x58df3dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x827cc010, ftCreationTime.dwHighDateTime=0x1d5d95c, ftLastAccessTime.dwLowDateTime=0x2b1954f0, ftLastAccessTime.dwHighDateTime=0x1d5def2, ftLastWriteTime.dwLowDateTime=0x2b1954f0, ftLastWriteTime.dwHighDateTime=0x1d5def2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0197.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df35c) returned 1 [0197.891] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rIREdumyZRX80jt2", nBufferLength=0x105, lpBuffer=0x58def04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rIREdumyZRX80jt2", lpFilePart=0x0) returned 0x38 [0197.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3cc) returned 1 [0197.891] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rIREdumyZRX80jt2", nBufferLength=0x105, lpBuffer=0x58deed4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rIREdumyZRX80jt2", lpFilePart=0x0) returned 0x38 [0197.891] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rIREdumyZRX80jt2\\", nBufferLength=0x105, lpBuffer=0x58deea8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rIREdumyZRX80jt2\\", lpFilePart=0x0) returned 0x39 [0197.891] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rIREdumyZRX80jt2\\*", lpFindFileData=0x58df0f4 | out: lpFindFileData=0x58df0f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x827cc010, ftCreationTime.dwHighDateTime=0x1d5d95c, ftLastAccessTime.dwLowDateTime=0x2b1954f0, ftLastAccessTime.dwHighDateTime=0x1d5def2, ftLastWriteTime.dwLowDateTime=0x2b1954f0, ftLastWriteTime.dwHighDateTime=0x1d5def2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0197.898] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x827cc010, ftCreationTime.dwHighDateTime=0x1d5d95c, ftLastAccessTime.dwLowDateTime=0x2b1954f0, ftLastAccessTime.dwHighDateTime=0x1d5def2, ftLastWriteTime.dwLowDateTime=0x2b1954f0, ftLastWriteTime.dwHighDateTime=0x1d5def2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.898] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cc94db0, ftCreationTime.dwHighDateTime=0x1d5dfc2, ftLastAccessTime.dwLowDateTime=0xe6943650, ftLastAccessTime.dwHighDateTime=0x1d5dd76, ftLastWriteTime.dwLowDateTime=0xe6943650, ftLastWriteTime.dwHighDateTime=0x1d5dd76, nFileSizeHigh=0x0, nFileSizeLow=0x17467, dwReserved0=0x0, dwReserved1=0x0, cFileName="0M71KkelAbwC8.xlsx", cAlternateFileName="0M71KK~1.XLS")) returned 1 [0197.898] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72390d70, ftCreationTime.dwHighDateTime=0x1d5e0e2, ftLastAccessTime.dwLowDateTime=0xd22881f0, ftLastAccessTime.dwHighDateTime=0x1d5d824, ftLastWriteTime.dwLowDateTime=0xd22881f0, ftLastWriteTime.dwHighDateTime=0x1d5d824, nFileSizeHigh=0x0, nFileSizeLow=0xe90b, dwReserved0=0x0, dwReserved1=0x0, cFileName="8KtwPy9.ods", cAlternateFileName="")) returned 1 [0197.898] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5326c490, ftCreationTime.dwHighDateTime=0x1d5e641, ftLastAccessTime.dwLowDateTime=0xd4453260, ftLastAccessTime.dwHighDateTime=0x1d5e604, ftLastWriteTime.dwLowDateTime=0xd4453260, ftLastWriteTime.dwHighDateTime=0x1d5e604, nFileSizeHigh=0x0, nFileSizeLow=0xccbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="C1 ODW887G.pps", cAlternateFileName="C1ODW8~1.PPS")) returned 1 [0197.899] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cbaf330, ftCreationTime.dwHighDateTime=0x1d5e49a, ftLastAccessTime.dwLowDateTime=0x8c4585f0, ftLastAccessTime.dwHighDateTime=0x1d5dc18, ftLastWriteTime.dwLowDateTime=0x8c4585f0, ftLastWriteTime.dwHighDateTime=0x1d5dc18, nFileSizeHigh=0x0, nFileSizeLow=0x21c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGsHL2wHSwlnfH.xlsx", cAlternateFileName="CGSHL2~1.XLS")) returned 1 [0197.899] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40605e40, ftCreationTime.dwHighDateTime=0x1d5df9b, ftLastAccessTime.dwLowDateTime=0xec13ee50, ftLastAccessTime.dwHighDateTime=0x1d5de65, ftLastWriteTime.dwLowDateTime=0xec13ee50, ftLastWriteTime.dwHighDateTime=0x1d5de65, nFileSizeHigh=0x0, nFileSizeLow=0x9352, dwReserved0=0x0, dwReserved1=0x0, cFileName="gxxzHBltxEQuwc.ots", cAlternateFileName="GXXZHB~1.OTS")) returned 1 [0197.899] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d995d70, ftCreationTime.dwHighDateTime=0x1d5e676, ftLastAccessTime.dwLowDateTime=0x4c236520, ftLastAccessTime.dwHighDateTime=0x1d5e747, ftLastWriteTime.dwLowDateTime=0x4c236520, ftLastWriteTime.dwHighDateTime=0x1d5e747, nFileSizeHigh=0x0, nFileSizeLow=0xa281, dwReserved0=0x0, dwReserved1=0x0, cFileName="xcr2uKhKZ8yefXR72fS.doc", cAlternateFileName="XCR2UK~1.DOC")) returned 1 [0197.899] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf7a9d30, ftCreationTime.dwHighDateTime=0x1d5dadb, ftLastAccessTime.dwLowDateTime=0x6af1d570, ftLastAccessTime.dwHighDateTime=0x1d5de3e, ftLastWriteTime.dwLowDateTime=0x6af1d570, ftLastWriteTime.dwHighDateTime=0x1d5de3e, nFileSizeHigh=0x0, nFileSizeLow=0xd62f, dwReserved0=0x0, dwReserved1=0x0, cFileName="YEJ-LkWtdHr.xlsx", cAlternateFileName="YEJ-LK~1.XLS")) returned 1 [0197.899] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf7a9d30, ftCreationTime.dwHighDateTime=0x1d5dadb, ftLastAccessTime.dwLowDateTime=0x6af1d570, ftLastAccessTime.dwHighDateTime=0x1d5de3e, ftLastWriteTime.dwLowDateTime=0x6af1d570, ftLastWriteTime.dwHighDateTime=0x1d5de3e, nFileSizeHigh=0x0, nFileSizeLow=0xd62f, dwReserved0=0x0, dwReserved1=0x0, cFileName="YEJ-LkWtdHr.xlsx", cAlternateFileName="YEJ-LK~1.XLS")) returned 0 [0197.899] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0197.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df38c) returned 1 [0197.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df398) returned 1 [0197.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3cc) returned 1 [0197.900] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rIREdumyZRX80jt2", nBufferLength=0x105, lpBuffer=0x58deed4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rIREdumyZRX80jt2", lpFilePart=0x0) returned 0x38 [0197.901] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rIREdumyZRX80jt2\\", nBufferLength=0x105, lpBuffer=0x58deea8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rIREdumyZRX80jt2\\", lpFilePart=0x0) returned 0x39 [0197.901] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rIREdumyZRX80jt2\\*", lpFindFileData=0x58df0f4 | out: lpFindFileData=0x58df0f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x827cc010, ftCreationTime.dwHighDateTime=0x1d5d95c, ftLastAccessTime.dwLowDateTime=0x2b1954f0, ftLastAccessTime.dwHighDateTime=0x1d5def2, ftLastWriteTime.dwLowDateTime=0x2b1954f0, ftLastWriteTime.dwHighDateTime=0x1d5def2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0197.901] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x827cc010, ftCreationTime.dwHighDateTime=0x1d5d95c, ftLastAccessTime.dwLowDateTime=0x2b1954f0, ftLastAccessTime.dwHighDateTime=0x1d5def2, ftLastWriteTime.dwLowDateTime=0x2b1954f0, ftLastWriteTime.dwHighDateTime=0x1d5def2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.902] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cc94db0, ftCreationTime.dwHighDateTime=0x1d5dfc2, ftLastAccessTime.dwLowDateTime=0xe6943650, ftLastAccessTime.dwHighDateTime=0x1d5dd76, ftLastWriteTime.dwLowDateTime=0xe6943650, ftLastWriteTime.dwHighDateTime=0x1d5dd76, nFileSizeHigh=0x0, nFileSizeLow=0x17467, dwReserved0=0x0, dwReserved1=0x0, cFileName="0M71KkelAbwC8.xlsx", cAlternateFileName="0M71KK~1.XLS")) returned 1 [0197.902] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72390d70, ftCreationTime.dwHighDateTime=0x1d5e0e2, ftLastAccessTime.dwLowDateTime=0xd22881f0, ftLastAccessTime.dwHighDateTime=0x1d5d824, ftLastWriteTime.dwLowDateTime=0xd22881f0, ftLastWriteTime.dwHighDateTime=0x1d5d824, nFileSizeHigh=0x0, nFileSizeLow=0xe90b, dwReserved0=0x0, dwReserved1=0x0, cFileName="8KtwPy9.ods", cAlternateFileName="")) returned 1 [0197.902] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5326c490, ftCreationTime.dwHighDateTime=0x1d5e641, ftLastAccessTime.dwLowDateTime=0xd4453260, ftLastAccessTime.dwHighDateTime=0x1d5e604, ftLastWriteTime.dwLowDateTime=0xd4453260, ftLastWriteTime.dwHighDateTime=0x1d5e604, nFileSizeHigh=0x0, nFileSizeLow=0xccbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="C1 ODW887G.pps", cAlternateFileName="C1ODW8~1.PPS")) returned 1 [0197.902] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cbaf330, ftCreationTime.dwHighDateTime=0x1d5e49a, ftLastAccessTime.dwLowDateTime=0x8c4585f0, ftLastAccessTime.dwHighDateTime=0x1d5dc18, ftLastWriteTime.dwLowDateTime=0x8c4585f0, ftLastWriteTime.dwHighDateTime=0x1d5dc18, nFileSizeHigh=0x0, nFileSizeLow=0x21c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGsHL2wHSwlnfH.xlsx", cAlternateFileName="CGSHL2~1.XLS")) returned 1 [0197.902] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40605e40, ftCreationTime.dwHighDateTime=0x1d5df9b, ftLastAccessTime.dwLowDateTime=0xec13ee50, ftLastAccessTime.dwHighDateTime=0x1d5de65, ftLastWriteTime.dwLowDateTime=0xec13ee50, ftLastWriteTime.dwHighDateTime=0x1d5de65, nFileSizeHigh=0x0, nFileSizeLow=0x9352, dwReserved0=0x0, dwReserved1=0x0, cFileName="gxxzHBltxEQuwc.ots", cAlternateFileName="GXXZHB~1.OTS")) returned 1 [0197.902] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d995d70, ftCreationTime.dwHighDateTime=0x1d5e676, ftLastAccessTime.dwLowDateTime=0x4c236520, ftLastAccessTime.dwHighDateTime=0x1d5e747, ftLastWriteTime.dwLowDateTime=0x4c236520, ftLastWriteTime.dwHighDateTime=0x1d5e747, nFileSizeHigh=0x0, nFileSizeLow=0xa281, dwReserved0=0x0, dwReserved1=0x0, cFileName="xcr2uKhKZ8yefXR72fS.doc", cAlternateFileName="XCR2UK~1.DOC")) returned 1 [0197.903] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf7a9d30, ftCreationTime.dwHighDateTime=0x1d5dadb, ftLastAccessTime.dwLowDateTime=0x6af1d570, ftLastAccessTime.dwHighDateTime=0x1d5de3e, ftLastWriteTime.dwLowDateTime=0x6af1d570, ftLastWriteTime.dwHighDateTime=0x1d5de3e, nFileSizeHigh=0x0, nFileSizeLow=0xd62f, dwReserved0=0x0, dwReserved1=0x0, cFileName="YEJ-LkWtdHr.xlsx", cAlternateFileName="YEJ-LK~1.XLS")) returned 1 [0197.903] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0197.903] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0197.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df38c) returned 1 [0197.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df398) returned 1 [0197.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df410) returned 1 [0197.904] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", nBufferLength=0x105, lpBuffer=0x58def18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", lpFilePart=0x0) returned 0x27 [0197.904] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", nBufferLength=0x105, lpBuffer=0x58deeec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", lpFilePart=0x0) returned 0x28 [0197.904] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*", lpFindFileData=0x58df138 | out: lpFindFileData=0x58df138*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdbe2d4a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbe2d4a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0197.904] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdbe2d4a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbe2d4a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.904] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc0cd120, ftCreationTime.dwHighDateTime=0x1d58431, ftLastAccessTime.dwLowDateTime=0xdea7f8a0, ftLastAccessTime.dwHighDateTime=0x1d5c4c1, ftLastWriteTime.dwLowDateTime=0xdea7f8a0, ftLastWriteTime.dwHighDateTime=0x1d5c4c1, nFileSizeHigh=0x0, nFileSizeLow=0x677e, dwReserved0=0x0, dwReserved1=0x0, cFileName="8-y4LOfY.xlsx", cAlternateFileName="8-Y4LO~1.XLS")) returned 1 [0197.904] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4363460, ftCreationTime.dwHighDateTime=0x1d57957, ftLastAccessTime.dwLowDateTime=0x84e126c0, ftLastAccessTime.dwHighDateTime=0x1d5e65e, ftLastWriteTime.dwLowDateTime=0x84e126c0, ftLastWriteTime.dwHighDateTime=0x1d5e65e, nFileSizeHigh=0x0, nFileSizeLow=0x11d97, dwReserved0=0x0, dwReserved1=0x0, cFileName="82nzDGjI 7XWXV_l.xlsx", cAlternateFileName="82NZDG~1.XLS")) returned 1 [0197.904] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40528c90, ftCreationTime.dwHighDateTime=0x1d5ae0c, ftLastAccessTime.dwLowDateTime=0x47d76e50, ftLastAccessTime.dwHighDateTime=0x1d56608, ftLastWriteTime.dwLowDateTime=0x47d76e50, ftLastWriteTime.dwHighDateTime=0x1d56608, nFileSizeHigh=0x0, nFileSizeLow=0xc77f, dwReserved0=0x0, dwReserved1=0x0, cFileName="8nrt26S7PviA02dyk.pptx", cAlternateFileName="8NRT26~1.PPT")) returned 1 [0197.905] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bb6c3f0, ftCreationTime.dwHighDateTime=0x1d55b36, ftLastAccessTime.dwLowDateTime=0x94f6d9a0, ftLastAccessTime.dwHighDateTime=0x1d5a6b3, ftLastWriteTime.dwLowDateTime=0x94f6d9a0, ftLastWriteTime.dwHighDateTime=0x1d5a6b3, nFileSizeHigh=0x0, nFileSizeLow=0x10517, dwReserved0=0x0, dwReserved1=0x0, cFileName="aV3XYxvgegC.docx", cAlternateFileName="AV3XYX~1.DOC")) returned 1 [0197.905] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddba0680, ftCreationTime.dwHighDateTime=0x1d5e3cb, ftLastAccessTime.dwLowDateTime=0xe835b1c0, ftLastAccessTime.dwHighDateTime=0x1d5e1de, ftLastWriteTime.dwLowDateTime=0xe835b1c0, ftLastWriteTime.dwHighDateTime=0x1d5e1de, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="b80m5N3teF4Nk1P", cAlternateFileName="B80M5N~1")) returned 1 [0197.905] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0197.905] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fbfcc80, ftCreationTime.dwHighDateTime=0x1d5b650, ftLastAccessTime.dwLowDateTime=0x7a8995f0, ftLastAccessTime.dwHighDateTime=0x1d5dee2, ftLastWriteTime.dwLowDateTime=0x7a8995f0, ftLastWriteTime.dwHighDateTime=0x1d5dee2, nFileSizeHigh=0x0, nFileSizeLow=0x12ca8, dwReserved0=0x0, dwReserved1=0x0, cFileName="gcBW 4OQaj.pptx", cAlternateFileName="GCBW4O~1.PPT")) returned 1 [0197.905] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4727ea0, ftCreationTime.dwHighDateTime=0x1d5a84b, ftLastAccessTime.dwLowDateTime=0x9643e170, ftLastAccessTime.dwHighDateTime=0x1d56d2b, ftLastWriteTime.dwLowDateTime=0x9643e170, ftLastWriteTime.dwHighDateTime=0x1d56d2b, nFileSizeHigh=0x0, nFileSizeLow=0xc01d, dwReserved0=0x0, dwReserved1=0x0, cFileName="gqp9rLKCCKsd05.docx", cAlternateFileName="GQP9RL~1.DOC")) returned 1 [0197.905] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0f4c730, ftCreationTime.dwHighDateTime=0x1d5d912, ftLastAccessTime.dwLowDateTime=0x4ee4cfe0, ftLastAccessTime.dwHighDateTime=0x1d5d871, ftLastWriteTime.dwLowDateTime=0x4ee4cfe0, ftLastWriteTime.dwHighDateTime=0x1d5d871, nFileSizeHigh=0x0, nFileSizeLow=0x133a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="h8I86FUVFr.docx", cAlternateFileName="H8I86F~1.DOC")) returned 1 [0197.905] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7fcb00, ftCreationTime.dwHighDateTime=0x1d5c170, ftLastAccessTime.dwLowDateTime=0x55e037b0, ftLastAccessTime.dwHighDateTime=0x1d5d297, ftLastWriteTime.dwLowDateTime=0x55e037b0, ftLastWriteTime.dwHighDateTime=0x1d5d297, nFileSizeHigh=0x0, nFileSizeLow=0x16388, dwReserved0=0x0, dwReserved1=0x0, cFileName="jQFpDdnAiB98NT.docx", cAlternateFileName="JQFPDD~1.DOC")) returned 1 [0197.906] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec194c0, ftCreationTime.dwHighDateTime=0x1d58036, ftLastAccessTime.dwLowDateTime=0xc3abd700, ftLastAccessTime.dwHighDateTime=0x1d5de26, ftLastWriteTime.dwLowDateTime=0xc3abd700, ftLastWriteTime.dwHighDateTime=0x1d5de26, nFileSizeHigh=0x0, nFileSizeLow=0x1303d, dwReserved0=0x0, dwReserved1=0x0, cFileName="KskcceHMsX7rT.xlsx", cAlternateFileName="KSKCCE~1.XLS")) returned 1 [0197.906] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0197.906] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0197.906] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0197.906] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0197.906] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ddcd580, ftCreationTime.dwHighDateTime=0x1d5a5f2, ftLastAccessTime.dwLowDateTime=0xea013500, ftLastAccessTime.dwHighDateTime=0x1d56160, ftLastWriteTime.dwLowDateTime=0xea013500, ftLastWriteTime.dwHighDateTime=0x1d56160, nFileSizeHigh=0x0, nFileSizeLow=0xd513, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nlXNmDoCq.pptx", cAlternateFileName="NLXNMD~1.PPT")) returned 1 [0197.906] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5f72ff0, ftCreationTime.dwHighDateTime=0x1d5a3ea, ftLastAccessTime.dwLowDateTime=0x76911260, ftLastAccessTime.dwHighDateTime=0x1d5a8ba, ftLastWriteTime.dwLowDateTime=0x76911260, ftLastWriteTime.dwHighDateTime=0x1d5a8ba, nFileSizeHigh=0x0, nFileSizeLow=0x1190c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oiYNJq9q1YIrgX.docx", cAlternateFileName="OIYNJQ~1.DOC")) returned 1 [0197.907] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8a4af3c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8a4af3c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0197.907] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedc3a100, ftCreationTime.dwHighDateTime=0x1d5dfa0, ftLastAccessTime.dwLowDateTime=0x63e311d0, ftLastAccessTime.dwHighDateTime=0x1d5db06, ftLastWriteTime.dwLowDateTime=0x63e311d0, ftLastWriteTime.dwHighDateTime=0x1d5db06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oX2xE8wIX", cAlternateFileName="OX2XE8~1")) returned 1 [0197.907] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78e00870, ftCreationTime.dwHighDateTime=0x1d59ca6, ftLastAccessTime.dwLowDateTime=0xb4a95c30, ftLastAccessTime.dwHighDateTime=0x1d580bd, ftLastWriteTime.dwLowDateTime=0xb4a95c30, ftLastWriteTime.dwHighDateTime=0x1d580bd, nFileSizeHigh=0x0, nFileSizeLow=0x930d, dwReserved0=0x0, dwReserved1=0x0, cFileName="PFyZqu_bN8iiDcWbYu.docx", cAlternateFileName="PFYZQU~1.DOC")) returned 1 [0197.907] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe817f210, ftCreationTime.dwHighDateTime=0x1d5e7e8, ftLastAccessTime.dwLowDateTime=0xf4cbeb50, ftLastAccessTime.dwHighDateTime=0x1d57ba6, ftLastWriteTime.dwLowDateTime=0xf4cbeb50, ftLastWriteTime.dwHighDateTime=0x1d57ba6, nFileSizeHigh=0x0, nFileSizeLow=0x178c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qAMKrJ s5aXEM2 DfBx.xlsx", cAlternateFileName="QAMKRJ~1.XLS")) returned 1 [0197.907] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a2ea540, ftCreationTime.dwHighDateTime=0x1d5da48, ftLastAccessTime.dwLowDateTime=0x52cdcad0, ftLastAccessTime.dwHighDateTime=0x1d5db9b, ftLastWriteTime.dwLowDateTime=0x52cdcad0, ftLastWriteTime.dwHighDateTime=0x1d5db9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QmUng5_ZXRVu", cAlternateFileName="QMUNG5~1")) returned 1 [0197.908] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a7ac60, ftCreationTime.dwHighDateTime=0x1d5e050, ftLastAccessTime.dwLowDateTime=0x44695690, ftLastAccessTime.dwHighDateTime=0x1d5d8fc, ftLastWriteTime.dwLowDateTime=0x44695690, ftLastWriteTime.dwHighDateTime=0x1d5d8fc, nFileSizeHigh=0x0, nFileSizeLow=0x11028, dwReserved0=0x0, dwReserved1=0x0, cFileName="R6MuKWr660ExY0xOP1YZ.doc", cAlternateFileName="R6MUKW~1.DOC")) returned 1 [0197.908] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x827cc010, ftCreationTime.dwHighDateTime=0x1d5d95c, ftLastAccessTime.dwLowDateTime=0x2b1954f0, ftLastAccessTime.dwHighDateTime=0x1d5def2, ftLastWriteTime.dwLowDateTime=0x2b1954f0, ftLastWriteTime.dwHighDateTime=0x1d5def2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rIREdumyZRX80jt2", cAlternateFileName="RIREDU~1")) returned 1 [0197.908] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdecb2f10, ftCreationTime.dwHighDateTime=0x1d5d8ac, ftLastAccessTime.dwLowDateTime=0x93a8cb30, ftLastAccessTime.dwHighDateTime=0x1d5bafe, ftLastWriteTime.dwLowDateTime=0x93a8cb30, ftLastWriteTime.dwHighDateTime=0x1d5bafe, nFileSizeHigh=0x0, nFileSizeLow=0x67cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RPane0VXyl-S.pptx", cAlternateFileName="RPANE0~1.PPT")) returned 1 [0197.908] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbeb1ff0, ftCreationTime.dwHighDateTime=0x1d568b4, ftLastAccessTime.dwLowDateTime=0x55cd4140, ftLastAccessTime.dwHighDateTime=0x1d5b6d2, ftLastWriteTime.dwLowDateTime=0x55cd4140, ftLastWriteTime.dwHighDateTime=0x1d5b6d2, nFileSizeHigh=0x0, nFileSizeLow=0xf4a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="XErx7u1YawDfT4d.xlsx", cAlternateFileName="XERX7U~1.XLS")) returned 1 [0197.908] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0124330, ftCreationTime.dwHighDateTime=0x1d56c09, ftLastAccessTime.dwLowDateTime=0x4e92e4d0, ftLastAccessTime.dwHighDateTime=0x1d59c64, ftLastWriteTime.dwLowDateTime=0x4e92e4d0, ftLastWriteTime.dwHighDateTime=0x1d59c64, nFileSizeHigh=0x0, nFileSizeLow=0x819b, dwReserved0=0x0, dwReserved1=0x0, cFileName="yEsc.pptx", cAlternateFileName="YESC~1.PPT")) returned 1 [0197.908] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0197.908] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0197.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3d0) returned 1 [0197.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3dc) returned 1 [0197.909] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", nBufferLength=0x105, lpBuffer=0x58def7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", lpFilePart=0x0) returned 0x27 [0197.909] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x58dee1c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0197.909] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Documents.txt", nBufferLength=0x105, lpBuffer=0x58dee30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Documents.txt", lpFilePart=0x0) returned 0x85 [0197.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df324) returned 1 [0197.909] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Documents.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs\\documents.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x4b0 [0197.910] GetFileType (hFile=0x4b0) returned 0x1 [0197.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df320) returned 1 [0197.911] GetFileType (hFile=0x4b0) returned 0x1 [0197.911] WriteFile (in: hFile=0x4b0, lpBuffer=0x24d6f4c*, nNumberOfBytesToWrite=0x559, lpNumberOfBytesWritten=0x58df3bc, lpOverlapped=0x0 | out: lpBuffer=0x24d6f4c*, lpNumberOfBytesWritten=0x58df3bc*=0x559, lpOverlapped=0x0) returned 1 [0197.912] CloseHandle (hObject=0x4b0) returned 1 [0197.912] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", nBufferLength=0x105, lpBuffer=0x58def48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", lpFilePart=0x0) returned 0x26 [0197.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3a4) returned 1 [0197.912] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures"), fInfoLevelId=0x0, lpFileInformation=0x58df420 | out: lpFileInformation=0x58df420*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdbf84100, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf84100, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3000)) returned 1 [0197.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3a0) returned 1 [0197.912] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", nBufferLength=0x105, lpBuffer=0x58def48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", lpFilePart=0x0) returned 0x26 [0197.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df410) returned 1 [0197.913] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", nBufferLength=0x105, lpBuffer=0x58def18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", lpFilePart=0x0) returned 0x26 [0197.913] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", nBufferLength=0x105, lpBuffer=0x58deeec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", lpFilePart=0x0) returned 0x27 [0197.913] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*", lpFindFileData=0x58df138 | out: lpFindFileData=0x58df138*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdbf84100, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf84100, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0197.913] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdbf84100, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf84100, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.919] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c28eb0, ftCreationTime.dwHighDateTime=0x1d5dafe, ftLastAccessTime.dwLowDateTime=0xe512e770, ftLastAccessTime.dwHighDateTime=0x1d5dc0b, ftLastWriteTime.dwLowDateTime=0xe512e770, ftLastWriteTime.dwHighDateTime=0x1d5dc0b, nFileSizeHigh=0x0, nFileSizeLow=0x89a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="-BRKLxTrDQf7q1zC--.bmp", cAlternateFileName="-BRKLX~1.BMP")) returned 1 [0197.919] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf9c5bb0, ftCreationTime.dwHighDateTime=0x1d5d9b2, ftLastAccessTime.dwLowDateTime=0x8d7bb590, ftLastAccessTime.dwHighDateTime=0x1d5da63, ftLastWriteTime.dwLowDateTime=0x8d7bb590, ftLastWriteTime.dwHighDateTime=0x1d5da63, nFileSizeHigh=0x0, nFileSizeLow=0x1639f, dwReserved0=0x0, dwReserved1=0x0, cFileName="3fOOr-tj.gif", cAlternateFileName="")) returned 1 [0197.919] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d250da0, ftCreationTime.dwHighDateTime=0x1d5df45, ftLastAccessTime.dwLowDateTime=0x333857f0, ftLastAccessTime.dwHighDateTime=0x1d5de78, ftLastWriteTime.dwLowDateTime=0x333857f0, ftLastWriteTime.dwHighDateTime=0x1d5de78, nFileSizeHigh=0x0, nFileSizeLow=0x91b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="71MI9ndSEEU5tAC.bmp", cAlternateFileName="71MI9N~1.BMP")) returned 1 [0197.919] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cc0f880, ftCreationTime.dwHighDateTime=0x1d5dbbf, ftLastAccessTime.dwLowDateTime=0x2d1ca300, ftLastAccessTime.dwHighDateTime=0x1d5d9e4, ftLastWriteTime.dwLowDateTime=0x2d1ca300, ftLastWriteTime.dwHighDateTime=0x1d5d9e4, nFileSizeHigh=0x0, nFileSizeLow=0x706d, dwReserved0=0x0, dwReserved1=0x0, cFileName="A5lN-_K.gif", cAlternateFileName="")) returned 1 [0197.919] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e410cd0, ftCreationTime.dwHighDateTime=0x1d5de52, ftLastAccessTime.dwLowDateTime=0xee400e40, ftLastAccessTime.dwHighDateTime=0x1d5d8a0, ftLastWriteTime.dwLowDateTime=0xee400e40, ftLastWriteTime.dwHighDateTime=0x1d5d8a0, nFileSizeHigh=0x0, nFileSizeLow=0x10654, dwReserved0=0x0, dwReserved1=0x0, cFileName="aD7vAKGbt-teGRGOf.bmp", cAlternateFileName="AD7VAK~1.BMP")) returned 1 [0197.919] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce82910, ftCreationTime.dwHighDateTime=0x1d5dbb8, ftLastAccessTime.dwLowDateTime=0x1fe522b0, ftLastAccessTime.dwHighDateTime=0x1d5df6c, ftLastWriteTime.dwLowDateTime=0x1fe522b0, ftLastWriteTime.dwHighDateTime=0x1d5df6c, nFileSizeHigh=0x0, nFileSizeLow=0xabad, dwReserved0=0x0, dwReserved1=0x0, cFileName="aVBuptDTVXCYrU.gif", cAlternateFileName="AVBUPT~1.GIF")) returned 1 [0197.920] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62eee2f0, ftCreationTime.dwHighDateTime=0x1d5e62c, ftLastAccessTime.dwLowDateTime=0xd50dd660, ftLastAccessTime.dwHighDateTime=0x1d5e600, ftLastWriteTime.dwLowDateTime=0xd50dd660, ftLastWriteTime.dwHighDateTime=0x1d5e600, nFileSizeHigh=0x0, nFileSizeLow=0xf955, dwReserved0=0x0, dwReserved1=0x0, cFileName="BGBHbSpDEyu-XJdGi6.jpg", cAlternateFileName="BGBHBS~1.JPG")) returned 1 [0197.920] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x436e79b0, ftCreationTime.dwHighDateTime=0x1d5da9a, ftLastAccessTime.dwLowDateTime=0xda136b60, ftLastAccessTime.dwHighDateTime=0x1d5dde6, ftLastWriteTime.dwLowDateTime=0xda136b60, ftLastWriteTime.dwHighDateTime=0x1d5dde6, nFileSizeHigh=0x0, nFileSizeLow=0xc7ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="c2i9T9ZdZ0iB.bmp", cAlternateFileName="C2I9T9~1.BMP")) returned 1 [0197.920] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a0d6c70, ftCreationTime.dwHighDateTime=0x1d5db58, ftLastAccessTime.dwLowDateTime=0xbe041b80, ftLastAccessTime.dwHighDateTime=0x1d5e675, ftLastWriteTime.dwLowDateTime=0xbe041b80, ftLastWriteTime.dwHighDateTime=0x1d5e675, nFileSizeHigh=0x0, nFileSizeLow=0x8b5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="cmZkXcJ0NAd803xVvT.jpg", cAlternateFileName="CMZKXC~1.JPG")) returned 1 [0197.920] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x390a43d0, ftCreationTime.dwHighDateTime=0x1d5dd94, ftLastAccessTime.dwLowDateTime=0x89c84590, ftLastAccessTime.dwHighDateTime=0x1d5d9d6, ftLastWriteTime.dwLowDateTime=0x89c84590, ftLastWriteTime.dwHighDateTime=0x1d5d9d6, nFileSizeHigh=0x0, nFileSizeLow=0xa9ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="CZ1cCRQ_KLTfRI8wQoMn.png", cAlternateFileName="CZ1CCR~1.PNG")) returned 1 [0197.920] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31d69690, ftCreationTime.dwHighDateTime=0x1d5e050, ftLastAccessTime.dwLowDateTime=0xad43a4f0, ftLastAccessTime.dwHighDateTime=0x1d5e3cd, ftLastWriteTime.dwLowDateTime=0xad43a4f0, ftLastWriteTime.dwHighDateTime=0x1d5e3cd, nFileSizeHigh=0x0, nFileSizeLow=0x25fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="CZbr9DWttkzQtmagXJ-z.gif", cAlternateFileName="CZBR9D~1.GIF")) returned 1 [0197.920] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7710670, ftCreationTime.dwHighDateTime=0x1d5d9e7, ftLastAccessTime.dwLowDateTime=0x5bcb95a0, ftLastAccessTime.dwHighDateTime=0x1d5e554, ftLastWriteTime.dwLowDateTime=0x5bcb95a0, ftLastWriteTime.dwHighDateTime=0x1d5e554, nFileSizeHigh=0x0, nFileSizeLow=0x1eef, dwReserved0=0x0, dwReserved1=0x0, cFileName="ddr1lcuPdatwN3L2.bmp", cAlternateFileName="DDR1LC~1.BMP")) returned 1 [0197.921] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0197.921] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f20cbe0, ftCreationTime.dwHighDateTime=0x1d5df45, ftLastAccessTime.dwLowDateTime=0xf86dd2c0, ftLastAccessTime.dwHighDateTime=0x1d5dfd6, ftLastWriteTime.dwLowDateTime=0xf86dd2c0, ftLastWriteTime.dwHighDateTime=0x1d5dfd6, nFileSizeHigh=0x0, nFileSizeLow=0x484b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ESRCIbGBEY9iOjypF4Be.gif", cAlternateFileName="ESRCIB~1.GIF")) returned 1 [0197.921] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34b9e9a0, ftCreationTime.dwHighDateTime=0x1d5e6a1, ftLastAccessTime.dwLowDateTime=0x8a30f8f0, ftLastAccessTime.dwHighDateTime=0x1d5e6fc, ftLastWriteTime.dwLowDateTime=0x8a30f8f0, ftLastWriteTime.dwHighDateTime=0x1d5e6fc, nFileSizeHigh=0x0, nFileSizeLow=0x1298f, dwReserved0=0x0, dwReserved1=0x0, cFileName="fKjFMjXeY69.jpg", cAlternateFileName="FKJFMJ~1.JPG")) returned 1 [0197.921] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24384df0, ftCreationTime.dwHighDateTime=0x1d5e021, ftLastAccessTime.dwLowDateTime=0xca923c60, ftLastAccessTime.dwHighDateTime=0x1d5e693, ftLastWriteTime.dwLowDateTime=0xca923c60, ftLastWriteTime.dwHighDateTime=0x1d5e693, nFileSizeHigh=0x0, nFileSizeLow=0x5de7, dwReserved0=0x0, dwReserved1=0x0, cFileName="fYPmZ4LF3.jpg", cAlternateFileName="FYPMZ4~1.JPG")) returned 1 [0197.921] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99472f40, ftCreationTime.dwHighDateTime=0x1d5e1bf, ftLastAccessTime.dwLowDateTime=0xc5385bc0, ftLastAccessTime.dwHighDateTime=0x1d5e72c, ftLastWriteTime.dwLowDateTime=0xc5385bc0, ftLastWriteTime.dwHighDateTime=0x1d5e72c, nFileSizeHigh=0x0, nFileSizeLow=0x17bd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="g2UGB7FSLw09NkiqQUi.png", cAlternateFileName="G2UGB7~1.PNG")) returned 1 [0197.921] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92bd6600, ftCreationTime.dwHighDateTime=0x1d5d998, ftLastAccessTime.dwLowDateTime=0x9878660, ftLastAccessTime.dwHighDateTime=0x1d5e670, ftLastWriteTime.dwLowDateTime=0x9878660, ftLastWriteTime.dwHighDateTime=0x1d5e670, nFileSizeHigh=0x0, nFileSizeLow=0x12bdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="gn-ZjDb.png", cAlternateFileName="")) returned 1 [0197.922] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7f32b90, ftCreationTime.dwHighDateTime=0x1d5e0c1, ftLastAccessTime.dwLowDateTime=0xa6232e70, ftLastAccessTime.dwHighDateTime=0x1d5e350, ftLastWriteTime.dwLowDateTime=0xa6232e70, ftLastWriteTime.dwHighDateTime=0x1d5e350, nFileSizeHigh=0x0, nFileSizeLow=0x794d, dwReserved0=0x0, dwReserved1=0x0, cFileName="GxPk.png", cAlternateFileName="")) returned 1 [0197.922] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90546e50, ftCreationTime.dwHighDateTime=0x1d5df14, ftLastAccessTime.dwLowDateTime=0x5c2ac20, ftLastAccessTime.dwHighDateTime=0x1d5d8fc, ftLastWriteTime.dwLowDateTime=0x5c2ac20, ftLastWriteTime.dwHighDateTime=0x1d5d8fc, nFileSizeHigh=0x0, nFileSizeLow=0x27b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="HRpZ-PAv6bn.gif", cAlternateFileName="HRPZ-P~1.GIF")) returned 1 [0197.922] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f451b80, ftCreationTime.dwHighDateTime=0x1d5dda5, ftLastAccessTime.dwLowDateTime=0x57544d70, ftLastAccessTime.dwHighDateTime=0x1d5e0b6, ftLastWriteTime.dwLowDateTime=0x57544d70, ftLastWriteTime.dwHighDateTime=0x1d5e0b6, nFileSizeHigh=0x0, nFileSizeLow=0x67f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="hXBfoDBSVT4yoHp.bmp", cAlternateFileName="HXBFOD~1.BMP")) returned 1 [0197.922] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c0621a0, ftCreationTime.dwHighDateTime=0x1d5d7ce, ftLastAccessTime.dwLowDateTime=0xc9c95ae0, ftLastAccessTime.dwHighDateTime=0x1d5de3f, ftLastWriteTime.dwLowDateTime=0xc9c95ae0, ftLastWriteTime.dwHighDateTime=0x1d5de3f, nFileSizeHigh=0x0, nFileSizeLow=0x12108, dwReserved0=0x0, dwReserved1=0x0, cFileName="HxxMXX3HX.jpg", cAlternateFileName="HXXMXX~1.JPG")) returned 1 [0197.922] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24316dc0, ftCreationTime.dwHighDateTime=0x1d5db0b, ftLastAccessTime.dwLowDateTime=0x95b35a0, ftLastAccessTime.dwHighDateTime=0x1d5db40, ftLastWriteTime.dwLowDateTime=0x95b35a0, ftLastWriteTime.dwHighDateTime=0x1d5db40, nFileSizeHigh=0x0, nFileSizeLow=0xce7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ixfl.png", cAlternateFileName="")) returned 1 [0197.922] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7cb3a40, ftCreationTime.dwHighDateTime=0x1d5db06, ftLastAccessTime.dwLowDateTime=0x71cc3e30, ftLastAccessTime.dwHighDateTime=0x1d5e6fe, ftLastWriteTime.dwLowDateTime=0x71cc3e30, ftLastWriteTime.dwHighDateTime=0x1d5e6fe, nFileSizeHigh=0x0, nFileSizeLow=0xf6ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="jeDUyPaiwFP-.bmp", cAlternateFileName="JEDUYP~1.BMP")) returned 1 [0197.923] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19801fa0, ftCreationTime.dwHighDateTime=0x1d5dd10, ftLastAccessTime.dwLowDateTime=0xabade880, ftLastAccessTime.dwHighDateTime=0x1d5dab3, ftLastWriteTime.dwLowDateTime=0xabade880, ftLastWriteTime.dwHighDateTime=0x1d5dab3, nFileSizeHigh=0x0, nFileSizeLow=0xd492, dwReserved0=0x0, dwReserved1=0x0, cFileName="lXsi6Keyn-.jpg", cAlternateFileName="LXSI6K~1.JPG")) returned 1 [0197.923] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77368240, ftCreationTime.dwHighDateTime=0x1d5e172, ftLastAccessTime.dwLowDateTime=0xd76983b0, ftLastAccessTime.dwHighDateTime=0x1d5dfec, ftLastWriteTime.dwLowDateTime=0xd76983b0, ftLastWriteTime.dwHighDateTime=0x1d5dfec, nFileSizeHigh=0x0, nFileSizeLow=0x5ea5, dwReserved0=0x0, dwReserved1=0x0, cFileName="mm358wJa6Q8te1kBB0.bmp", cAlternateFileName="MM358W~1.BMP")) returned 1 [0197.923] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37790040, ftCreationTime.dwHighDateTime=0x1d5da85, ftLastAccessTime.dwLowDateTime=0xb43945e0, ftLastAccessTime.dwHighDateTime=0x1d5deef, ftLastWriteTime.dwLowDateTime=0xb43945e0, ftLastWriteTime.dwHighDateTime=0x1d5deef, nFileSizeHigh=0x0, nFileSizeLow=0xf117, dwReserved0=0x0, dwReserved1=0x0, cFileName="oSsCw2.bmp", cAlternateFileName="")) returned 1 [0197.923] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e55d70, ftCreationTime.dwHighDateTime=0x1d5e37a, ftLastAccessTime.dwLowDateTime=0x750cfb50, ftLastAccessTime.dwHighDateTime=0x1d5e30e, ftLastWriteTime.dwLowDateTime=0x750cfb50, ftLastWriteTime.dwHighDateTime=0x1d5e30e, nFileSizeHigh=0x0, nFileSizeLow=0x8c9d, dwReserved0=0x0, dwReserved1=0x0, cFileName="RJS.jpg", cAlternateFileName="")) returned 1 [0197.923] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5f53650, ftCreationTime.dwHighDateTime=0x1d5db84, ftLastAccessTime.dwLowDateTime=0xcbcb4680, ftLastAccessTime.dwHighDateTime=0x1d5e670, ftLastWriteTime.dwLowDateTime=0xcbcb4680, ftLastWriteTime.dwHighDateTime=0x1d5e670, nFileSizeHigh=0x0, nFileSizeLow=0x6f42, dwReserved0=0x0, dwReserved1=0x0, cFileName="rKG_ 4pKufjKiSJ3ZyM.png", cAlternateFileName="RKG_4P~1.PNG")) returned 1 [0197.923] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6336f0, ftCreationTime.dwHighDateTime=0x1d5e098, ftLastAccessTime.dwLowDateTime=0x2e9e8fb0, ftLastAccessTime.dwHighDateTime=0x1d5e577, ftLastWriteTime.dwLowDateTime=0x2e9e8fb0, ftLastWriteTime.dwHighDateTime=0x1d5e577, nFileSizeHigh=0x0, nFileSizeLow=0x7743, dwReserved0=0x0, dwReserved1=0x0, cFileName="s38yY 7dCzHMGxTR.png", cAlternateFileName="S38YY7~1.PNG")) returned 1 [0197.924] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59c462a0, ftCreationTime.dwHighDateTime=0x1d5e130, ftLastAccessTime.dwLowDateTime=0x763fcab0, ftLastAccessTime.dwHighDateTime=0x1d5e279, ftLastWriteTime.dwLowDateTime=0x763fcab0, ftLastWriteTime.dwHighDateTime=0x1d5e279, nFileSizeHigh=0x0, nFileSizeLow=0x4983, dwReserved0=0x0, dwReserved1=0x0, cFileName="SuTjmQruPj.jpg", cAlternateFileName="SUTJMQ~1.JPG")) returned 1 [0197.935] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11124f90, ftCreationTime.dwHighDateTime=0x1d5d988, ftLastAccessTime.dwLowDateTime=0x4090d960, ftLastAccessTime.dwHighDateTime=0x1d5e1e6, ftLastWriteTime.dwLowDateTime=0x4090d960, ftLastWriteTime.dwHighDateTime=0x1d5e1e6, nFileSizeHigh=0x0, nFileSizeLow=0x17685, dwReserved0=0x0, dwReserved1=0x0, cFileName="U1YuAXT.jpg", cAlternateFileName="")) returned 1 [0197.935] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fcf34a0, ftCreationTime.dwHighDateTime=0x1d5ddbb, ftLastAccessTime.dwLowDateTime=0x7bbb8260, ftLastAccessTime.dwHighDateTime=0x1d5dd86, ftLastWriteTime.dwLowDateTime=0x7bbb8260, ftLastWriteTime.dwHighDateTime=0x1d5dd86, nFileSizeHigh=0x0, nFileSizeLow=0x51a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="uer47nTFIa.bmp", cAlternateFileName="UER47N~1.BMP")) returned 1 [0197.935] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc38a18f0, ftCreationTime.dwHighDateTime=0x1d5e16d, ftLastAccessTime.dwLowDateTime=0x72a81190, ftLastAccessTime.dwHighDateTime=0x1d5e153, ftLastWriteTime.dwLowDateTime=0x72a81190, ftLastWriteTime.dwHighDateTime=0x1d5e153, nFileSizeHigh=0x0, nFileSizeLow=0xd091, dwReserved0=0x0, dwReserved1=0x0, cFileName="UZnU.bmp", cAlternateFileName="")) returned 1 [0197.935] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82609b00, ftCreationTime.dwHighDateTime=0x1d5d9a8, ftLastAccessTime.dwLowDateTime=0x8496b2f0, ftLastAccessTime.dwHighDateTime=0x1d5e7a0, ftLastWriteTime.dwLowDateTime=0x8496b2f0, ftLastWriteTime.dwHighDateTime=0x1d5e7a0, nFileSizeHigh=0x0, nFileSizeLow=0xc786, dwReserved0=0x0, dwReserved1=0x0, cFileName="V54n7rzEj4K.png", cAlternateFileName="V54N7R~1.PNG")) returned 1 [0197.935] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49df51b0, ftCreationTime.dwHighDateTime=0x1d5e6bc, ftLastAccessTime.dwLowDateTime=0x7cbb8730, ftLastAccessTime.dwHighDateTime=0x1d5e0fd, ftLastWriteTime.dwLowDateTime=0x7cbb8730, ftLastWriteTime.dwHighDateTime=0x1d5e0fd, nFileSizeHigh=0x0, nFileSizeLow=0x1730b, dwReserved0=0x0, dwReserved1=0x0, cFileName="VCc5.bmp", cAlternateFileName="")) returned 1 [0197.936] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x168b8d0, ftCreationTime.dwHighDateTime=0x1d5e69a, ftLastAccessTime.dwLowDateTime=0xfd62eb70, ftLastAccessTime.dwHighDateTime=0x1d5dc3a, ftLastWriteTime.dwLowDateTime=0xfd62eb70, ftLastWriteTime.dwHighDateTime=0x1d5dc3a, nFileSizeHigh=0x0, nFileSizeLow=0x556e, dwReserved0=0x0, dwReserved1=0x0, cFileName="vQQ2D-7N55c.gif", cAlternateFileName="VQQ2D-~1.GIF")) returned 1 [0197.936] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f45030, ftCreationTime.dwHighDateTime=0x1d5dc39, ftLastAccessTime.dwLowDateTime=0x16bb1f90, ftLastAccessTime.dwHighDateTime=0x1d5e3dc, ftLastWriteTime.dwLowDateTime=0x16bb1f90, ftLastWriteTime.dwHighDateTime=0x1d5e3dc, nFileSizeHigh=0x0, nFileSizeLow=0xf92e, dwReserved0=0x0, dwReserved1=0x0, cFileName="VRprTu8a1KFGc5YDi.bmp", cAlternateFileName="VRPRTU~1.BMP")) returned 1 [0197.936] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4aca9d0, ftCreationTime.dwHighDateTime=0x1d5dda5, ftLastAccessTime.dwLowDateTime=0x2d25a920, ftLastAccessTime.dwHighDateTime=0x1d5de15, ftLastWriteTime.dwLowDateTime=0x2d25a920, ftLastWriteTime.dwHighDateTime=0x1d5de15, nFileSizeHigh=0x0, nFileSizeLow=0x189dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="YmHktCzsi7P.gif", cAlternateFileName="YMHKTC~1.GIF")) returned 1 [0197.936] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc49db5f0, ftCreationTime.dwHighDateTime=0x1d5e1e8, ftLastAccessTime.dwLowDateTime=0x54e76bb0, ftLastAccessTime.dwHighDateTime=0x1d5e130, ftLastWriteTime.dwLowDateTime=0x54e76bb0, ftLastWriteTime.dwHighDateTime=0x1d5e130, nFileSizeHigh=0x0, nFileSizeLow=0xf92f, dwReserved0=0x0, dwReserved1=0x0, cFileName="YZvLg50Le5JU2L12Ab.gif", cAlternateFileName="YZVLG5~1.GIF")) returned 1 [0197.936] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4c98020, ftCreationTime.dwHighDateTime=0x1d5d9da, ftLastAccessTime.dwLowDateTime=0xa0be3840, ftLastAccessTime.dwHighDateTime=0x1d5e34f, ftLastWriteTime.dwLowDateTime=0xa0be3840, ftLastWriteTime.dwHighDateTime=0x1d5e34f, nFileSizeHigh=0x0, nFileSizeLow=0x7766, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZxOBzF3IrR49Erv.gif", cAlternateFileName="ZXOBZF~1.GIF")) returned 1 [0197.936] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4c98020, ftCreationTime.dwHighDateTime=0x1d5d9da, ftLastAccessTime.dwLowDateTime=0xa0be3840, ftLastAccessTime.dwHighDateTime=0x1d5e34f, ftLastWriteTime.dwLowDateTime=0xa0be3840, ftLastWriteTime.dwHighDateTime=0x1d5e34f, nFileSizeHigh=0x0, nFileSizeLow=0x7766, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZxOBzF3IrR49Erv.gif", cAlternateFileName="ZXOBZF~1.GIF")) returned 0 [0197.937] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0197.937] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3d0) returned 1 [0197.937] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3dc) returned 1 [0197.937] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df410) returned 1 [0197.937] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", nBufferLength=0x105, lpBuffer=0x58def18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", lpFilePart=0x0) returned 0x26 [0197.937] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", nBufferLength=0x105, lpBuffer=0x58deeec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", lpFilePart=0x0) returned 0x27 [0197.937] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*", lpFindFileData=0x58df138 | out: lpFindFileData=0x58df138*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdbf84100, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf84100, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0197.937] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdbf84100, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf84100, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.937] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c28eb0, ftCreationTime.dwHighDateTime=0x1d5dafe, ftLastAccessTime.dwLowDateTime=0xe512e770, ftLastAccessTime.dwHighDateTime=0x1d5dc0b, ftLastWriteTime.dwLowDateTime=0xe512e770, ftLastWriteTime.dwHighDateTime=0x1d5dc0b, nFileSizeHigh=0x0, nFileSizeLow=0x89a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="-BRKLxTrDQf7q1zC--.bmp", cAlternateFileName="-BRKLX~1.BMP")) returned 1 [0197.938] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf9c5bb0, ftCreationTime.dwHighDateTime=0x1d5d9b2, ftLastAccessTime.dwLowDateTime=0x8d7bb590, ftLastAccessTime.dwHighDateTime=0x1d5da63, ftLastWriteTime.dwLowDateTime=0x8d7bb590, ftLastWriteTime.dwHighDateTime=0x1d5da63, nFileSizeHigh=0x0, nFileSizeLow=0x1639f, dwReserved0=0x0, dwReserved1=0x0, cFileName="3fOOr-tj.gif", cAlternateFileName="")) returned 1 [0197.938] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d250da0, ftCreationTime.dwHighDateTime=0x1d5df45, ftLastAccessTime.dwLowDateTime=0x333857f0, ftLastAccessTime.dwHighDateTime=0x1d5de78, ftLastWriteTime.dwLowDateTime=0x333857f0, ftLastWriteTime.dwHighDateTime=0x1d5de78, nFileSizeHigh=0x0, nFileSizeLow=0x91b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="71MI9ndSEEU5tAC.bmp", cAlternateFileName="71MI9N~1.BMP")) returned 1 [0197.938] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cc0f880, ftCreationTime.dwHighDateTime=0x1d5dbbf, ftLastAccessTime.dwLowDateTime=0x2d1ca300, ftLastAccessTime.dwHighDateTime=0x1d5d9e4, ftLastWriteTime.dwLowDateTime=0x2d1ca300, ftLastWriteTime.dwHighDateTime=0x1d5d9e4, nFileSizeHigh=0x0, nFileSizeLow=0x706d, dwReserved0=0x0, dwReserved1=0x0, cFileName="A5lN-_K.gif", cAlternateFileName="")) returned 1 [0197.938] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e410cd0, ftCreationTime.dwHighDateTime=0x1d5de52, ftLastAccessTime.dwLowDateTime=0xee400e40, ftLastAccessTime.dwHighDateTime=0x1d5d8a0, ftLastWriteTime.dwLowDateTime=0xee400e40, ftLastWriteTime.dwHighDateTime=0x1d5d8a0, nFileSizeHigh=0x0, nFileSizeLow=0x10654, dwReserved0=0x0, dwReserved1=0x0, cFileName="aD7vAKGbt-teGRGOf.bmp", cAlternateFileName="AD7VAK~1.BMP")) returned 1 [0197.938] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce82910, ftCreationTime.dwHighDateTime=0x1d5dbb8, ftLastAccessTime.dwLowDateTime=0x1fe522b0, ftLastAccessTime.dwHighDateTime=0x1d5df6c, ftLastWriteTime.dwLowDateTime=0x1fe522b0, ftLastWriteTime.dwHighDateTime=0x1d5df6c, nFileSizeHigh=0x0, nFileSizeLow=0xabad, dwReserved0=0x0, dwReserved1=0x0, cFileName="aVBuptDTVXCYrU.gif", cAlternateFileName="AVBUPT~1.GIF")) returned 1 [0197.938] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62eee2f0, ftCreationTime.dwHighDateTime=0x1d5e62c, ftLastAccessTime.dwLowDateTime=0xd50dd660, ftLastAccessTime.dwHighDateTime=0x1d5e600, ftLastWriteTime.dwLowDateTime=0xd50dd660, ftLastWriteTime.dwHighDateTime=0x1d5e600, nFileSizeHigh=0x0, nFileSizeLow=0xf955, dwReserved0=0x0, dwReserved1=0x0, cFileName="BGBHbSpDEyu-XJdGi6.jpg", cAlternateFileName="BGBHBS~1.JPG")) returned 1 [0197.938] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x436e79b0, ftCreationTime.dwHighDateTime=0x1d5da9a, ftLastAccessTime.dwLowDateTime=0xda136b60, ftLastAccessTime.dwHighDateTime=0x1d5dde6, ftLastWriteTime.dwLowDateTime=0xda136b60, ftLastWriteTime.dwHighDateTime=0x1d5dde6, nFileSizeHigh=0x0, nFileSizeLow=0xc7ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="c2i9T9ZdZ0iB.bmp", cAlternateFileName="C2I9T9~1.BMP")) returned 1 [0197.939] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a0d6c70, ftCreationTime.dwHighDateTime=0x1d5db58, ftLastAccessTime.dwLowDateTime=0xbe041b80, ftLastAccessTime.dwHighDateTime=0x1d5e675, ftLastWriteTime.dwLowDateTime=0xbe041b80, ftLastWriteTime.dwHighDateTime=0x1d5e675, nFileSizeHigh=0x0, nFileSizeLow=0x8b5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="cmZkXcJ0NAd803xVvT.jpg", cAlternateFileName="CMZKXC~1.JPG")) returned 1 [0197.939] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x390a43d0, ftCreationTime.dwHighDateTime=0x1d5dd94, ftLastAccessTime.dwLowDateTime=0x89c84590, ftLastAccessTime.dwHighDateTime=0x1d5d9d6, ftLastWriteTime.dwLowDateTime=0x89c84590, ftLastWriteTime.dwHighDateTime=0x1d5d9d6, nFileSizeHigh=0x0, nFileSizeLow=0xa9ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="CZ1cCRQ_KLTfRI8wQoMn.png", cAlternateFileName="CZ1CCR~1.PNG")) returned 1 [0197.939] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31d69690, ftCreationTime.dwHighDateTime=0x1d5e050, ftLastAccessTime.dwLowDateTime=0xad43a4f0, ftLastAccessTime.dwHighDateTime=0x1d5e3cd, ftLastWriteTime.dwLowDateTime=0xad43a4f0, ftLastWriteTime.dwHighDateTime=0x1d5e3cd, nFileSizeHigh=0x0, nFileSizeLow=0x25fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="CZbr9DWttkzQtmagXJ-z.gif", cAlternateFileName="CZBR9D~1.GIF")) returned 1 [0197.939] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7710670, ftCreationTime.dwHighDateTime=0x1d5d9e7, ftLastAccessTime.dwLowDateTime=0x5bcb95a0, ftLastAccessTime.dwHighDateTime=0x1d5e554, ftLastWriteTime.dwLowDateTime=0x5bcb95a0, ftLastWriteTime.dwHighDateTime=0x1d5e554, nFileSizeHigh=0x0, nFileSizeLow=0x1eef, dwReserved0=0x0, dwReserved1=0x0, cFileName="ddr1lcuPdatwN3L2.bmp", cAlternateFileName="DDR1LC~1.BMP")) returned 1 [0197.939] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0197.939] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f20cbe0, ftCreationTime.dwHighDateTime=0x1d5df45, ftLastAccessTime.dwLowDateTime=0xf86dd2c0, ftLastAccessTime.dwHighDateTime=0x1d5dfd6, ftLastWriteTime.dwLowDateTime=0xf86dd2c0, ftLastWriteTime.dwHighDateTime=0x1d5dfd6, nFileSizeHigh=0x0, nFileSizeLow=0x484b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ESRCIbGBEY9iOjypF4Be.gif", cAlternateFileName="ESRCIB~1.GIF")) returned 1 [0197.939] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34b9e9a0, ftCreationTime.dwHighDateTime=0x1d5e6a1, ftLastAccessTime.dwLowDateTime=0x8a30f8f0, ftLastAccessTime.dwHighDateTime=0x1d5e6fc, ftLastWriteTime.dwLowDateTime=0x8a30f8f0, ftLastWriteTime.dwHighDateTime=0x1d5e6fc, nFileSizeHigh=0x0, nFileSizeLow=0x1298f, dwReserved0=0x0, dwReserved1=0x0, cFileName="fKjFMjXeY69.jpg", cAlternateFileName="FKJFMJ~1.JPG")) returned 1 [0197.939] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24384df0, ftCreationTime.dwHighDateTime=0x1d5e021, ftLastAccessTime.dwLowDateTime=0xca923c60, ftLastAccessTime.dwHighDateTime=0x1d5e693, ftLastWriteTime.dwLowDateTime=0xca923c60, ftLastWriteTime.dwHighDateTime=0x1d5e693, nFileSizeHigh=0x0, nFileSizeLow=0x5de7, dwReserved0=0x0, dwReserved1=0x0, cFileName="fYPmZ4LF3.jpg", cAlternateFileName="FYPMZ4~1.JPG")) returned 1 [0197.940] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99472f40, ftCreationTime.dwHighDateTime=0x1d5e1bf, ftLastAccessTime.dwLowDateTime=0xc5385bc0, ftLastAccessTime.dwHighDateTime=0x1d5e72c, ftLastWriteTime.dwLowDateTime=0xc5385bc0, ftLastWriteTime.dwHighDateTime=0x1d5e72c, nFileSizeHigh=0x0, nFileSizeLow=0x17bd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="g2UGB7FSLw09NkiqQUi.png", cAlternateFileName="G2UGB7~1.PNG")) returned 1 [0197.940] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92bd6600, ftCreationTime.dwHighDateTime=0x1d5d998, ftLastAccessTime.dwLowDateTime=0x9878660, ftLastAccessTime.dwHighDateTime=0x1d5e670, ftLastWriteTime.dwLowDateTime=0x9878660, ftLastWriteTime.dwHighDateTime=0x1d5e670, nFileSizeHigh=0x0, nFileSizeLow=0x12bdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="gn-ZjDb.png", cAlternateFileName="")) returned 1 [0197.940] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7f32b90, ftCreationTime.dwHighDateTime=0x1d5e0c1, ftLastAccessTime.dwLowDateTime=0xa6232e70, ftLastAccessTime.dwHighDateTime=0x1d5e350, ftLastWriteTime.dwLowDateTime=0xa6232e70, ftLastWriteTime.dwHighDateTime=0x1d5e350, nFileSizeHigh=0x0, nFileSizeLow=0x794d, dwReserved0=0x0, dwReserved1=0x0, cFileName="GxPk.png", cAlternateFileName="")) returned 1 [0197.940] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90546e50, ftCreationTime.dwHighDateTime=0x1d5df14, ftLastAccessTime.dwLowDateTime=0x5c2ac20, ftLastAccessTime.dwHighDateTime=0x1d5d8fc, ftLastWriteTime.dwLowDateTime=0x5c2ac20, ftLastWriteTime.dwHighDateTime=0x1d5d8fc, nFileSizeHigh=0x0, nFileSizeLow=0x27b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="HRpZ-PAv6bn.gif", cAlternateFileName="HRPZ-P~1.GIF")) returned 1 [0197.940] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f451b80, ftCreationTime.dwHighDateTime=0x1d5dda5, ftLastAccessTime.dwLowDateTime=0x57544d70, ftLastAccessTime.dwHighDateTime=0x1d5e0b6, ftLastWriteTime.dwLowDateTime=0x57544d70, ftLastWriteTime.dwHighDateTime=0x1d5e0b6, nFileSizeHigh=0x0, nFileSizeLow=0x67f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="hXBfoDBSVT4yoHp.bmp", cAlternateFileName="HXBFOD~1.BMP")) returned 1 [0197.940] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c0621a0, ftCreationTime.dwHighDateTime=0x1d5d7ce, ftLastAccessTime.dwLowDateTime=0xc9c95ae0, ftLastAccessTime.dwHighDateTime=0x1d5de3f, ftLastWriteTime.dwLowDateTime=0xc9c95ae0, ftLastWriteTime.dwHighDateTime=0x1d5de3f, nFileSizeHigh=0x0, nFileSizeLow=0x12108, dwReserved0=0x0, dwReserved1=0x0, cFileName="HxxMXX3HX.jpg", cAlternateFileName="HXXMXX~1.JPG")) returned 1 [0197.940] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24316dc0, ftCreationTime.dwHighDateTime=0x1d5db0b, ftLastAccessTime.dwLowDateTime=0x95b35a0, ftLastAccessTime.dwHighDateTime=0x1d5db40, ftLastWriteTime.dwLowDateTime=0x95b35a0, ftLastWriteTime.dwHighDateTime=0x1d5db40, nFileSizeHigh=0x0, nFileSizeLow=0xce7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ixfl.png", cAlternateFileName="")) returned 1 [0197.941] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7cb3a40, ftCreationTime.dwHighDateTime=0x1d5db06, ftLastAccessTime.dwLowDateTime=0x71cc3e30, ftLastAccessTime.dwHighDateTime=0x1d5e6fe, ftLastWriteTime.dwLowDateTime=0x71cc3e30, ftLastWriteTime.dwHighDateTime=0x1d5e6fe, nFileSizeHigh=0x0, nFileSizeLow=0xf6ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="jeDUyPaiwFP-.bmp", cAlternateFileName="JEDUYP~1.BMP")) returned 1 [0197.941] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19801fa0, ftCreationTime.dwHighDateTime=0x1d5dd10, ftLastAccessTime.dwLowDateTime=0xabade880, ftLastAccessTime.dwHighDateTime=0x1d5dab3, ftLastWriteTime.dwLowDateTime=0xabade880, ftLastWriteTime.dwHighDateTime=0x1d5dab3, nFileSizeHigh=0x0, nFileSizeLow=0xd492, dwReserved0=0x0, dwReserved1=0x0, cFileName="lXsi6Keyn-.jpg", cAlternateFileName="LXSI6K~1.JPG")) returned 1 [0197.941] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77368240, ftCreationTime.dwHighDateTime=0x1d5e172, ftLastAccessTime.dwLowDateTime=0xd76983b0, ftLastAccessTime.dwHighDateTime=0x1d5dfec, ftLastWriteTime.dwLowDateTime=0xd76983b0, ftLastWriteTime.dwHighDateTime=0x1d5dfec, nFileSizeHigh=0x0, nFileSizeLow=0x5ea5, dwReserved0=0x0, dwReserved1=0x0, cFileName="mm358wJa6Q8te1kBB0.bmp", cAlternateFileName="MM358W~1.BMP")) returned 1 [0197.941] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37790040, ftCreationTime.dwHighDateTime=0x1d5da85, ftLastAccessTime.dwLowDateTime=0xb43945e0, ftLastAccessTime.dwHighDateTime=0x1d5deef, ftLastWriteTime.dwLowDateTime=0xb43945e0, ftLastWriteTime.dwHighDateTime=0x1d5deef, nFileSizeHigh=0x0, nFileSizeLow=0xf117, dwReserved0=0x0, dwReserved1=0x0, cFileName="oSsCw2.bmp", cAlternateFileName="")) returned 1 [0197.941] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e55d70, ftCreationTime.dwHighDateTime=0x1d5e37a, ftLastAccessTime.dwLowDateTime=0x750cfb50, ftLastAccessTime.dwHighDateTime=0x1d5e30e, ftLastWriteTime.dwLowDateTime=0x750cfb50, ftLastWriteTime.dwHighDateTime=0x1d5e30e, nFileSizeHigh=0x0, nFileSizeLow=0x8c9d, dwReserved0=0x0, dwReserved1=0x0, cFileName="RJS.jpg", cAlternateFileName="")) returned 1 [0197.941] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5f53650, ftCreationTime.dwHighDateTime=0x1d5db84, ftLastAccessTime.dwLowDateTime=0xcbcb4680, ftLastAccessTime.dwHighDateTime=0x1d5e670, ftLastWriteTime.dwLowDateTime=0xcbcb4680, ftLastWriteTime.dwHighDateTime=0x1d5e670, nFileSizeHigh=0x0, nFileSizeLow=0x6f42, dwReserved0=0x0, dwReserved1=0x0, cFileName="rKG_ 4pKufjKiSJ3ZyM.png", cAlternateFileName="RKG_4P~1.PNG")) returned 1 [0197.941] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6336f0, ftCreationTime.dwHighDateTime=0x1d5e098, ftLastAccessTime.dwLowDateTime=0x2e9e8fb0, ftLastAccessTime.dwHighDateTime=0x1d5e577, ftLastWriteTime.dwLowDateTime=0x2e9e8fb0, ftLastWriteTime.dwHighDateTime=0x1d5e577, nFileSizeHigh=0x0, nFileSizeLow=0x7743, dwReserved0=0x0, dwReserved1=0x0, cFileName="s38yY 7dCzHMGxTR.png", cAlternateFileName="S38YY7~1.PNG")) returned 1 [0197.942] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59c462a0, ftCreationTime.dwHighDateTime=0x1d5e130, ftLastAccessTime.dwLowDateTime=0x763fcab0, ftLastAccessTime.dwHighDateTime=0x1d5e279, ftLastWriteTime.dwLowDateTime=0x763fcab0, ftLastWriteTime.dwHighDateTime=0x1d5e279, nFileSizeHigh=0x0, nFileSizeLow=0x4983, dwReserved0=0x0, dwReserved1=0x0, cFileName="SuTjmQruPj.jpg", cAlternateFileName="SUTJMQ~1.JPG")) returned 1 [0197.942] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11124f90, ftCreationTime.dwHighDateTime=0x1d5d988, ftLastAccessTime.dwLowDateTime=0x4090d960, ftLastAccessTime.dwHighDateTime=0x1d5e1e6, ftLastWriteTime.dwLowDateTime=0x4090d960, ftLastWriteTime.dwHighDateTime=0x1d5e1e6, nFileSizeHigh=0x0, nFileSizeLow=0x17685, dwReserved0=0x0, dwReserved1=0x0, cFileName="U1YuAXT.jpg", cAlternateFileName="")) returned 1 [0197.942] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fcf34a0, ftCreationTime.dwHighDateTime=0x1d5ddbb, ftLastAccessTime.dwLowDateTime=0x7bbb8260, ftLastAccessTime.dwHighDateTime=0x1d5dd86, ftLastWriteTime.dwLowDateTime=0x7bbb8260, ftLastWriteTime.dwHighDateTime=0x1d5dd86, nFileSizeHigh=0x0, nFileSizeLow=0x51a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="uer47nTFIa.bmp", cAlternateFileName="UER47N~1.BMP")) returned 1 [0197.942] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc38a18f0, ftCreationTime.dwHighDateTime=0x1d5e16d, ftLastAccessTime.dwLowDateTime=0x72a81190, ftLastAccessTime.dwHighDateTime=0x1d5e153, ftLastWriteTime.dwLowDateTime=0x72a81190, ftLastWriteTime.dwHighDateTime=0x1d5e153, nFileSizeHigh=0x0, nFileSizeLow=0xd091, dwReserved0=0x0, dwReserved1=0x0, cFileName="UZnU.bmp", cAlternateFileName="")) returned 1 [0197.942] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82609b00, ftCreationTime.dwHighDateTime=0x1d5d9a8, ftLastAccessTime.dwLowDateTime=0x8496b2f0, ftLastAccessTime.dwHighDateTime=0x1d5e7a0, ftLastWriteTime.dwLowDateTime=0x8496b2f0, ftLastWriteTime.dwHighDateTime=0x1d5e7a0, nFileSizeHigh=0x0, nFileSizeLow=0xc786, dwReserved0=0x0, dwReserved1=0x0, cFileName="V54n7rzEj4K.png", cAlternateFileName="V54N7R~1.PNG")) returned 1 [0197.942] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49df51b0, ftCreationTime.dwHighDateTime=0x1d5e6bc, ftLastAccessTime.dwLowDateTime=0x7cbb8730, ftLastAccessTime.dwHighDateTime=0x1d5e0fd, ftLastWriteTime.dwLowDateTime=0x7cbb8730, ftLastWriteTime.dwHighDateTime=0x1d5e0fd, nFileSizeHigh=0x0, nFileSizeLow=0x1730b, dwReserved0=0x0, dwReserved1=0x0, cFileName="VCc5.bmp", cAlternateFileName="")) returned 1 [0197.943] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x168b8d0, ftCreationTime.dwHighDateTime=0x1d5e69a, ftLastAccessTime.dwLowDateTime=0xfd62eb70, ftLastAccessTime.dwHighDateTime=0x1d5dc3a, ftLastWriteTime.dwLowDateTime=0xfd62eb70, ftLastWriteTime.dwHighDateTime=0x1d5dc3a, nFileSizeHigh=0x0, nFileSizeLow=0x556e, dwReserved0=0x0, dwReserved1=0x0, cFileName="vQQ2D-7N55c.gif", cAlternateFileName="VQQ2D-~1.GIF")) returned 1 [0197.943] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f45030, ftCreationTime.dwHighDateTime=0x1d5dc39, ftLastAccessTime.dwLowDateTime=0x16bb1f90, ftLastAccessTime.dwHighDateTime=0x1d5e3dc, ftLastWriteTime.dwLowDateTime=0x16bb1f90, ftLastWriteTime.dwHighDateTime=0x1d5e3dc, nFileSizeHigh=0x0, nFileSizeLow=0xf92e, dwReserved0=0x0, dwReserved1=0x0, cFileName="VRprTu8a1KFGc5YDi.bmp", cAlternateFileName="VRPRTU~1.BMP")) returned 1 [0197.943] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4aca9d0, ftCreationTime.dwHighDateTime=0x1d5dda5, ftLastAccessTime.dwLowDateTime=0x2d25a920, ftLastAccessTime.dwHighDateTime=0x1d5de15, ftLastWriteTime.dwLowDateTime=0x2d25a920, ftLastWriteTime.dwHighDateTime=0x1d5de15, nFileSizeHigh=0x0, nFileSizeLow=0x189dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="YmHktCzsi7P.gif", cAlternateFileName="YMHKTC~1.GIF")) returned 1 [0197.943] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc49db5f0, ftCreationTime.dwHighDateTime=0x1d5e1e8, ftLastAccessTime.dwLowDateTime=0x54e76bb0, ftLastAccessTime.dwHighDateTime=0x1d5e130, ftLastWriteTime.dwLowDateTime=0x54e76bb0, ftLastWriteTime.dwHighDateTime=0x1d5e130, nFileSizeHigh=0x0, nFileSizeLow=0xf92f, dwReserved0=0x0, dwReserved1=0x0, cFileName="YZvLg50Le5JU2L12Ab.gif", cAlternateFileName="YZVLG5~1.GIF")) returned 1 [0197.943] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4c98020, ftCreationTime.dwHighDateTime=0x1d5d9da, ftLastAccessTime.dwLowDateTime=0xa0be3840, ftLastAccessTime.dwHighDateTime=0x1d5e34f, ftLastWriteTime.dwLowDateTime=0xa0be3840, ftLastWriteTime.dwHighDateTime=0x1d5e34f, nFileSizeHigh=0x0, nFileSizeLow=0x7766, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZxOBzF3IrR49Erv.gif", cAlternateFileName="ZXOBZF~1.GIF")) returned 1 [0197.943] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0197.943] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0197.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3d0) returned 1 [0197.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3dc) returned 1 [0197.944] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", nBufferLength=0x105, lpBuffer=0x58def7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", lpFilePart=0x0) returned 0x26 [0197.944] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x58dee1c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0197.944] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Pictures.txt", nBufferLength=0x105, lpBuffer=0x58dee30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Pictures.txt", lpFilePart=0x0) returned 0x84 [0197.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df324) returned 1 [0197.944] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Pictures.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs\\pictures.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x4b0 [0197.945] GetFileType (hFile=0x4b0) returned 0x1 [0197.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df320) returned 1 [0197.945] GetFileType (hFile=0x4b0) returned 0x1 [0197.945] WriteFile (in: hFile=0x4b0, lpBuffer=0x24e7c24*, nNumberOfBytesToWrite=0x31f, lpNumberOfBytesWritten=0x58df3bc, lpOverlapped=0x0 | out: lpBuffer=0x24e7c24*, lpNumberOfBytesWritten=0x58df3bc*=0x31f, lpOverlapped=0x0) returned 1 [0197.946] CloseHandle (hObject=0x4b0) returned 1 [0197.946] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos", nBufferLength=0x105, lpBuffer=0x58def48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos", lpFilePart=0x0) returned 0x24 [0197.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3a4) returned 1 [0197.946] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos"), fInfoLevelId=0x0, lpFileInformation=0x58df420 | out: lpFileInformation=0x58df420*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdbf11ce0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf11ce0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0197.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3a0) returned 1 [0197.947] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos", nBufferLength=0x105, lpBuffer=0x58def48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos", lpFilePart=0x0) returned 0x24 [0197.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df410) returned 1 [0197.947] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos", nBufferLength=0x105, lpBuffer=0x58def18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos", lpFilePart=0x0) returned 0x24 [0197.947] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\", nBufferLength=0x105, lpBuffer=0x58deeec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\", lpFilePart=0x0) returned 0x25 [0197.947] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\*", lpFindFileData=0x58df138 | out: lpFindFileData=0x58df138*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdbf11ce0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf11ce0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0197.947] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdbf11ce0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf11ce0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.947] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8bc769b0, ftCreationTime.dwHighDateTime=0x1d5e6f7, ftLastAccessTime.dwLowDateTime=0xdaac6e50, ftLastAccessTime.dwHighDateTime=0x1d5db39, ftLastWriteTime.dwLowDateTime=0xdaac6e50, ftLastWriteTime.dwHighDateTime=0x1d5db39, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1Xq74mC5Z6A7", cAlternateFileName="1XQ74M~1")) returned 1 [0197.947] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f0f6890, ftCreationTime.dwHighDateTime=0x1d5de6e, ftLastAccessTime.dwLowDateTime=0xc0915950, ftLastAccessTime.dwHighDateTime=0x1d5e0d3, ftLastWriteTime.dwLowDateTime=0xc0915950, ftLastWriteTime.dwHighDateTime=0x1d5e0d3, nFileSizeHigh=0x0, nFileSizeLow=0xa1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="AKpjDRBtV4E.flv", cAlternateFileName="AKPJDR~1.FLV")) returned 1 [0197.948] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0197.948] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x370dc2f0, ftCreationTime.dwHighDateTime=0x1d5e136, ftLastAccessTime.dwLowDateTime=0x6c325100, ftLastAccessTime.dwHighDateTime=0x1d5d9e6, ftLastWriteTime.dwLowDateTime=0x6c325100, ftLastWriteTime.dwHighDateTime=0x1d5d9e6, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="iz6YTcyqH6vys1VH.mp4", cAlternateFileName="IZ6YTC~1.MP4")) returned 1 [0197.948] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb66bf550, ftCreationTime.dwHighDateTime=0x1d5dde7, ftLastAccessTime.dwLowDateTime=0xb5e8c0d0, ftLastAccessTime.dwHighDateTime=0x1d5daa0, ftLastWriteTime.dwLowDateTime=0xb5e8c0d0, ftLastWriteTime.dwHighDateTime=0x1d5daa0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sUB5", cAlternateFileName="")) returned 1 [0197.948] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5e489d0, ftCreationTime.dwHighDateTime=0x1d5e6a8, ftLastAccessTime.dwLowDateTime=0x5db58210, ftLastAccessTime.dwHighDateTime=0x1d5e3e5, ftLastWriteTime.dwLowDateTime=0x5db58210, ftLastWriteTime.dwHighDateTime=0x1d5e3e5, nFileSizeHigh=0x0, nFileSizeLow=0x4735, dwReserved0=0x0, dwReserved1=0x0, cFileName="t1Wr.flv", cAlternateFileName="")) returned 1 [0197.948] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67c14b80, ftCreationTime.dwHighDateTime=0x1d5dd79, ftLastAccessTime.dwLowDateTime=0x4065cb70, ftLastAccessTime.dwHighDateTime=0x1d5e38b, ftLastWriteTime.dwLowDateTime=0x4065cb70, ftLastWriteTime.dwHighDateTime=0x1d5e38b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="yndAXana", cAlternateFileName="")) returned 1 [0197.948] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0197.948] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0197.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3d0) returned 1 [0197.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3dc) returned 1 [0197.949] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\.", nBufferLength=0x105, lpBuffer=0x58deed0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7", lpFilePart=0x0) returned 0x31 [0197.949] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7", nBufferLength=0x105, lpBuffer=0x58def04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7", lpFilePart=0x0) returned 0x31 [0197.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df360) returned 1 [0197.949] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1xq74mc5z6a7"), fInfoLevelId=0x0, lpFileInformation=0x58df3dc | out: lpFileInformation=0x58df3dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8bc769b0, ftCreationTime.dwHighDateTime=0x1d5e6f7, ftLastAccessTime.dwLowDateTime=0xdaac6e50, ftLastAccessTime.dwHighDateTime=0x1d5db39, ftLastWriteTime.dwLowDateTime=0xdaac6e50, ftLastWriteTime.dwHighDateTime=0x1d5db39, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0197.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df35c) returned 1 [0197.954] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7", nBufferLength=0x105, lpBuffer=0x58def04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7", lpFilePart=0x0) returned 0x31 [0197.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3cc) returned 1 [0197.954] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7", nBufferLength=0x105, lpBuffer=0x58deed4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7", lpFilePart=0x0) returned 0x31 [0197.954] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\", nBufferLength=0x105, lpBuffer=0x58deea8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\", lpFilePart=0x0) returned 0x32 [0197.954] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\*", lpFindFileData=0x58df0f4 | out: lpFindFileData=0x58df0f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8bc769b0, ftCreationTime.dwHighDateTime=0x1d5e6f7, ftLastAccessTime.dwLowDateTime=0xdaac6e50, ftLastAccessTime.dwHighDateTime=0x1d5db39, ftLastWriteTime.dwLowDateTime=0xdaac6e50, ftLastWriteTime.dwHighDateTime=0x1d5db39, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0197.955] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8bc769b0, ftCreationTime.dwHighDateTime=0x1d5e6f7, ftLastAccessTime.dwLowDateTime=0xdaac6e50, ftLastAccessTime.dwHighDateTime=0x1d5db39, ftLastWriteTime.dwLowDateTime=0xdaac6e50, ftLastWriteTime.dwHighDateTime=0x1d5db39, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.955] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b0a9720, ftCreationTime.dwHighDateTime=0x1d5e290, ftLastAccessTime.dwLowDateTime=0x87d59150, ftLastAccessTime.dwHighDateTime=0x1d5d7e9, ftLastWriteTime.dwLowDateTime=0x87d59150, ftLastWriteTime.dwHighDateTime=0x1d5d7e9, nFileSizeHigh=0x0, nFileSizeLow=0x1268d, dwReserved0=0x0, dwReserved1=0x0, cFileName="bcQJ97S.flv", cAlternateFileName="")) returned 1 [0197.955] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a3c9270, ftCreationTime.dwHighDateTime=0x1d5df2c, ftLastAccessTime.dwLowDateTime=0x5d8bbbc0, ftLastAccessTime.dwHighDateTime=0x1d5dc0a, ftLastWriteTime.dwLowDateTime=0x5d8bbbc0, ftLastWriteTime.dwHighDateTime=0x1d5dc0a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jrlzcN", cAlternateFileName="")) returned 1 [0197.955] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb67e6b20, ftCreationTime.dwHighDateTime=0x1d5e4a6, ftLastAccessTime.dwLowDateTime=0x9f93d270, ftLastAccessTime.dwHighDateTime=0x1d5dad2, ftLastWriteTime.dwLowDateTime=0x9f93d270, ftLastWriteTime.dwHighDateTime=0x1d5dad2, nFileSizeHigh=0x0, nFileSizeLow=0x18ead, dwReserved0=0x0, dwReserved1=0x0, cFileName="VF-j.swf", cAlternateFileName="")) returned 1 [0197.955] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb67e6b20, ftCreationTime.dwHighDateTime=0x1d5e4a6, ftLastAccessTime.dwLowDateTime=0x9f93d270, ftLastAccessTime.dwHighDateTime=0x1d5dad2, ftLastWriteTime.dwLowDateTime=0x9f93d270, ftLastWriteTime.dwHighDateTime=0x1d5dad2, nFileSizeHigh=0x0, nFileSizeLow=0x18ead, dwReserved0=0x0, dwReserved1=0x0, cFileName="VF-j.swf", cAlternateFileName="")) returned 0 [0197.955] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0197.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df38c) returned 1 [0197.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df398) returned 1 [0197.956] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\.", nBufferLength=0x105, lpBuffer=0x58dee8c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN", lpFilePart=0x0) returned 0x38 [0197.956] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN", nBufferLength=0x105, lpBuffer=0x58deec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN", lpFilePart=0x0) returned 0x38 [0197.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df31c) returned 1 [0197.956] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1xq74mc5z6a7\\jrlzcn"), fInfoLevelId=0x0, lpFileInformation=0x58df398 | out: lpFileInformation=0x58df398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a3c9270, ftCreationTime.dwHighDateTime=0x1d5df2c, ftLastAccessTime.dwLowDateTime=0x5d8bbbc0, ftLastAccessTime.dwHighDateTime=0x1d5dc0a, ftLastWriteTime.dwLowDateTime=0x5d8bbbc0, ftLastWriteTime.dwHighDateTime=0x1d5dc0a, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0197.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df318) returned 1 [0197.961] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN", nBufferLength=0x105, lpBuffer=0x58deec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN", lpFilePart=0x0) returned 0x38 [0197.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df388) returned 1 [0197.961] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN", nBufferLength=0x105, lpBuffer=0x58dee90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN", lpFilePart=0x0) returned 0x38 [0197.961] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\", nBufferLength=0x105, lpBuffer=0x58dee64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\", lpFilePart=0x0) returned 0x39 [0197.961] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\*", lpFindFileData=0x58df0b0 | out: lpFindFileData=0x58df0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a3c9270, ftCreationTime.dwHighDateTime=0x1d5df2c, ftLastAccessTime.dwLowDateTime=0x5d8bbbc0, ftLastAccessTime.dwHighDateTime=0x1d5dc0a, ftLastWriteTime.dwLowDateTime=0x5d8bbbc0, ftLastWriteTime.dwHighDateTime=0x1d5dc0a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0197.962] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a3c9270, ftCreationTime.dwHighDateTime=0x1d5df2c, ftLastAccessTime.dwLowDateTime=0x5d8bbbc0, ftLastAccessTime.dwHighDateTime=0x1d5dc0a, ftLastWriteTime.dwLowDateTime=0x5d8bbbc0, ftLastWriteTime.dwHighDateTime=0x1d5dc0a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.962] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x470d0b90, ftCreationTime.dwHighDateTime=0x1d5da4a, ftLastAccessTime.dwLowDateTime=0x76263b20, ftLastAccessTime.dwHighDateTime=0x1d5e74e, ftLastWriteTime.dwLowDateTime=0x76263b20, ftLastWriteTime.dwHighDateTime=0x1d5e74e, nFileSizeHigh=0x0, nFileSizeLow=0x835b, dwReserved0=0x0, dwReserved1=0x0, cFileName="fu8Lf11wf4XDZYYv.mp4", cAlternateFileName="FU8LF1~1.MP4")) returned 1 [0197.962] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6adbab0, ftCreationTime.dwHighDateTime=0x1d5e21d, ftLastAccessTime.dwLowDateTime=0x6eceb9f0, ftLastAccessTime.dwHighDateTime=0x1d5e56f, ftLastWriteTime.dwLowDateTime=0x6eceb9f0, ftLastWriteTime.dwHighDateTime=0x1d5e56f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="R5LIt1", cAlternateFileName="")) returned 1 [0197.962] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0197.962] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0197.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df348) returned 1 [0197.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df354) returned 1 [0197.962] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\.", nBufferLength=0x105, lpBuffer=0x58dee48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1", lpFilePart=0x0) returned 0x3f [0197.962] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1", nBufferLength=0x105, lpBuffer=0x58dee7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1", lpFilePart=0x0) returned 0x3f [0197.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df2d8) returned 1 [0197.963] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1xq74mc5z6a7\\jrlzcn\\r5lit1"), fInfoLevelId=0x0, lpFileInformation=0x58df354 | out: lpFileInformation=0x58df354*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6adbab0, ftCreationTime.dwHighDateTime=0x1d5e21d, ftLastAccessTime.dwLowDateTime=0x6eceb9f0, ftLastAccessTime.dwHighDateTime=0x1d5e56f, ftLastWriteTime.dwLowDateTime=0x6eceb9f0, ftLastWriteTime.dwHighDateTime=0x1d5e56f, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0198.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df2d4) returned 1 [0198.145] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1", nBufferLength=0x105, lpBuffer=0x58dee7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1", lpFilePart=0x0) returned 0x3f [0198.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df344) returned 1 [0198.145] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1", nBufferLength=0x105, lpBuffer=0x58dee4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1", lpFilePart=0x0) returned 0x3f [0198.145] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\", nBufferLength=0x105, lpBuffer=0x58dee20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\", lpFilePart=0x0) returned 0x40 [0198.145] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\*", lpFindFileData=0x58df06c | out: lpFindFileData=0x58df06c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6adbab0, ftCreationTime.dwHighDateTime=0x1d5e21d, ftLastAccessTime.dwLowDateTime=0x6eceb9f0, ftLastAccessTime.dwHighDateTime=0x1d5e56f, ftLastWriteTime.dwLowDateTime=0x6eceb9f0, ftLastWriteTime.dwHighDateTime=0x1d5e56f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.150] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6adbab0, ftCreationTime.dwHighDateTime=0x1d5e21d, ftLastAccessTime.dwLowDateTime=0x6eceb9f0, ftLastAccessTime.dwHighDateTime=0x1d5e56f, ftLastWriteTime.dwLowDateTime=0x6eceb9f0, ftLastWriteTime.dwHighDateTime=0x1d5e56f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.150] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc724fd30, ftCreationTime.dwHighDateTime=0x1d5db7e, ftLastAccessTime.dwLowDateTime=0x3461be70, ftLastAccessTime.dwHighDateTime=0x1d5dd54, ftLastWriteTime.dwLowDateTime=0x3461be70, ftLastWriteTime.dwHighDateTime=0x1d5dd54, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1EBa", cAlternateFileName="")) returned 1 [0198.150] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62de3da0, ftCreationTime.dwHighDateTime=0x1d5d8e5, ftLastAccessTime.dwLowDateTime=0x51144910, ftLastAccessTime.dwHighDateTime=0x1d5e2f0, ftLastWriteTime.dwLowDateTime=0x51144910, ftLastWriteTime.dwHighDateTime=0x1d5e2f0, nFileSizeHigh=0x0, nFileSizeLow=0x8e9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="5qLoKDmvFfdmoFZ5v.avi", cAlternateFileName="5QLOKD~1.AVI")) returned 1 [0198.150] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6658fe0, ftCreationTime.dwHighDateTime=0x1d5ddc4, ftLastAccessTime.dwLowDateTime=0x24a09d40, ftLastAccessTime.dwHighDateTime=0x1d5d9ed, ftLastWriteTime.dwLowDateTime=0x24a09d40, ftLastWriteTime.dwHighDateTime=0x1d5d9ed, nFileSizeHigh=0x0, nFileSizeLow=0x18134, dwReserved0=0x0, dwReserved1=0x0, cFileName="6DZggA1Ty.flv", cAlternateFileName="6DZGGA~1.FLV")) returned 1 [0198.151] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0457700, ftCreationTime.dwHighDateTime=0x1d5dd3b, ftLastAccessTime.dwLowDateTime=0xede074b0, ftLastAccessTime.dwHighDateTime=0x1d5e149, ftLastWriteTime.dwLowDateTime=0xede074b0, ftLastWriteTime.dwHighDateTime=0x1d5e149, nFileSizeHigh=0x0, nFileSizeLow=0x2bde, dwReserved0=0x0, dwReserved1=0x0, cFileName="j5RouV1j7HnFN.mkv", cAlternateFileName="J5ROUV~1.MKV")) returned 1 [0198.151] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20799b00, ftCreationTime.dwHighDateTime=0x1d5e09f, ftLastAccessTime.dwLowDateTime=0xc78d7f60, ftLastAccessTime.dwHighDateTime=0x1d5e347, ftLastWriteTime.dwLowDateTime=0xc78d7f60, ftLastWriteTime.dwHighDateTime=0x1d5e347, nFileSizeHigh=0x0, nFileSizeLow=0x9f43, dwReserved0=0x0, dwReserved1=0x0, cFileName="NFagidh2b.avi", cAlternateFileName="NFAGID~1.AVI")) returned 1 [0198.151] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x291ccc50, ftCreationTime.dwHighDateTime=0x1d5dd6b, ftLastAccessTime.dwLowDateTime=0x11d73660, ftLastAccessTime.dwHighDateTime=0x1d5e2c1, ftLastWriteTime.dwLowDateTime=0x11d73660, ftLastWriteTime.dwHighDateTime=0x1d5e2c1, nFileSizeHigh=0x0, nFileSizeLow=0xd56c, dwReserved0=0x0, dwReserved1=0x0, cFileName="T9wsPG.mp4", cAlternateFileName="")) returned 1 [0198.151] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x291ccc50, ftCreationTime.dwHighDateTime=0x1d5dd6b, ftLastAccessTime.dwLowDateTime=0x11d73660, ftLastAccessTime.dwHighDateTime=0x1d5e2c1, ftLastWriteTime.dwLowDateTime=0x11d73660, ftLastWriteTime.dwHighDateTime=0x1d5e2c1, nFileSizeHigh=0x0, nFileSizeLow=0xd56c, dwReserved0=0x0, dwReserved1=0x0, cFileName="T9wsPG.mp4", cAlternateFileName="")) returned 0 [0198.151] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df304) returned 1 [0198.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df310) returned 1 [0198.152] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\1EBa\\.", nBufferLength=0x105, lpBuffer=0x58dee04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\1EBa", lpFilePart=0x0) returned 0x44 [0198.152] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\1EBa", nBufferLength=0x105, lpBuffer=0x58dee38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\1EBa", lpFilePart=0x0) returned 0x44 [0198.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df294) returned 1 [0198.152] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\1EBa" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1xq74mc5z6a7\\jrlzcn\\r5lit1\\1eba"), fInfoLevelId=0x0, lpFileInformation=0x58df310 | out: lpFileInformation=0x58df310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc724fd30, ftCreationTime.dwHighDateTime=0x1d5db7e, ftLastAccessTime.dwLowDateTime=0x3461be70, ftLastAccessTime.dwHighDateTime=0x1d5dd54, ftLastWriteTime.dwLowDateTime=0x3461be70, ftLastWriteTime.dwHighDateTime=0x1d5dd54, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0198.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df290) returned 1 [0198.166] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\1EBa", nBufferLength=0x105, lpBuffer=0x58dee38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\1EBa", lpFilePart=0x0) returned 0x44 [0198.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df300) returned 1 [0198.166] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\1EBa", nBufferLength=0x105, lpBuffer=0x58dee08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\1EBa", lpFilePart=0x0) returned 0x44 [0198.166] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\1EBa\\", nBufferLength=0x105, lpBuffer=0x58deddc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\1EBa\\", lpFilePart=0x0) returned 0x45 [0198.166] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\1EBa\\*", lpFindFileData=0x58df028 | out: lpFindFileData=0x58df028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc724fd30, ftCreationTime.dwHighDateTime=0x1d5db7e, ftLastAccessTime.dwLowDateTime=0x3461be70, ftLastAccessTime.dwHighDateTime=0x1d5dd54, ftLastWriteTime.dwLowDateTime=0x3461be70, ftLastWriteTime.dwHighDateTime=0x1d5dd54, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.167] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df038 | out: lpFindFileData=0x58df038*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc724fd30, ftCreationTime.dwHighDateTime=0x1d5db7e, ftLastAccessTime.dwLowDateTime=0x3461be70, ftLastAccessTime.dwHighDateTime=0x1d5dd54, ftLastWriteTime.dwLowDateTime=0x3461be70, ftLastWriteTime.dwHighDateTime=0x1d5dd54, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.167] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df038 | out: lpFindFileData=0x58df038*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5c45600, ftCreationTime.dwHighDateTime=0x1d5e2c2, ftLastAccessTime.dwLowDateTime=0x297c3500, ftLastAccessTime.dwHighDateTime=0x1d5e18a, ftLastWriteTime.dwLowDateTime=0x297c3500, ftLastWriteTime.dwHighDateTime=0x1d5e18a, nFileSizeHigh=0x0, nFileSizeLow=0x13a12, dwReserved0=0x0, dwReserved1=0x0, cFileName="e PdeInE20xW S.mkv", cAlternateFileName="EPDEIN~1.MKV")) returned 1 [0198.167] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df038 | out: lpFindFileData=0x58df038*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5c45600, ftCreationTime.dwHighDateTime=0x1d5e2c2, ftLastAccessTime.dwLowDateTime=0x297c3500, ftLastAccessTime.dwHighDateTime=0x1d5e18a, ftLastWriteTime.dwLowDateTime=0x297c3500, ftLastWriteTime.dwHighDateTime=0x1d5e18a, nFileSizeHigh=0x0, nFileSizeLow=0x13a12, dwReserved0=0x0, dwReserved1=0x0, cFileName="e PdeInE20xW S.mkv", cAlternateFileName="EPDEIN~1.MKV")) returned 0 [0198.167] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.167] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df2c0) returned 1 [0198.167] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df2cc) returned 1 [0198.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df300) returned 1 [0198.167] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\1EBa", nBufferLength=0x105, lpBuffer=0x58dee08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\1EBa", lpFilePart=0x0) returned 0x44 [0198.167] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\1EBa\\", nBufferLength=0x105, lpBuffer=0x58deddc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\1EBa\\", lpFilePart=0x0) returned 0x45 [0198.168] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\1EBa\\*", lpFindFileData=0x58df028 | out: lpFindFileData=0x58df028*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc724fd30, ftCreationTime.dwHighDateTime=0x1d5db7e, ftLastAccessTime.dwLowDateTime=0x3461be70, ftLastAccessTime.dwHighDateTime=0x1d5dd54, ftLastWriteTime.dwLowDateTime=0x3461be70, ftLastWriteTime.dwHighDateTime=0x1d5dd54, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.168] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df038 | out: lpFindFileData=0x58df038*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc724fd30, ftCreationTime.dwHighDateTime=0x1d5db7e, ftLastAccessTime.dwLowDateTime=0x3461be70, ftLastAccessTime.dwHighDateTime=0x1d5dd54, ftLastWriteTime.dwLowDateTime=0x3461be70, ftLastWriteTime.dwHighDateTime=0x1d5dd54, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.168] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df038 | out: lpFindFileData=0x58df038*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5c45600, ftCreationTime.dwHighDateTime=0x1d5e2c2, ftLastAccessTime.dwLowDateTime=0x297c3500, ftLastAccessTime.dwHighDateTime=0x1d5e18a, ftLastWriteTime.dwLowDateTime=0x297c3500, ftLastWriteTime.dwHighDateTime=0x1d5e18a, nFileSizeHigh=0x0, nFileSizeLow=0x13a12, dwReserved0=0x0, dwReserved1=0x0, cFileName="e PdeInE20xW S.mkv", cAlternateFileName="EPDEIN~1.MKV")) returned 1 [0198.168] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df038 | out: lpFindFileData=0x58df038*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0198.168] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.168] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df2c0) returned 1 [0198.168] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df2cc) returned 1 [0198.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df344) returned 1 [0198.168] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1", nBufferLength=0x105, lpBuffer=0x58dee4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1", lpFilePart=0x0) returned 0x3f [0198.168] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\", nBufferLength=0x105, lpBuffer=0x58dee20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\", lpFilePart=0x0) returned 0x40 [0198.168] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\R5LIt1\\*", lpFindFileData=0x58df06c | out: lpFindFileData=0x58df06c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6adbab0, ftCreationTime.dwHighDateTime=0x1d5e21d, ftLastAccessTime.dwLowDateTime=0x6eceb9f0, ftLastAccessTime.dwHighDateTime=0x1d5e56f, ftLastWriteTime.dwLowDateTime=0x6eceb9f0, ftLastWriteTime.dwHighDateTime=0x1d5e56f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.169] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6adbab0, ftCreationTime.dwHighDateTime=0x1d5e21d, ftLastAccessTime.dwLowDateTime=0x6eceb9f0, ftLastAccessTime.dwHighDateTime=0x1d5e56f, ftLastWriteTime.dwLowDateTime=0x6eceb9f0, ftLastWriteTime.dwHighDateTime=0x1d5e56f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.169] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc724fd30, ftCreationTime.dwHighDateTime=0x1d5db7e, ftLastAccessTime.dwLowDateTime=0x3461be70, ftLastAccessTime.dwHighDateTime=0x1d5dd54, ftLastWriteTime.dwLowDateTime=0x3461be70, ftLastWriteTime.dwHighDateTime=0x1d5dd54, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1EBa", cAlternateFileName="")) returned 1 [0198.169] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62de3da0, ftCreationTime.dwHighDateTime=0x1d5d8e5, ftLastAccessTime.dwLowDateTime=0x51144910, ftLastAccessTime.dwHighDateTime=0x1d5e2f0, ftLastWriteTime.dwLowDateTime=0x51144910, ftLastWriteTime.dwHighDateTime=0x1d5e2f0, nFileSizeHigh=0x0, nFileSizeLow=0x8e9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="5qLoKDmvFfdmoFZ5v.avi", cAlternateFileName="5QLOKD~1.AVI")) returned 1 [0198.169] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6658fe0, ftCreationTime.dwHighDateTime=0x1d5ddc4, ftLastAccessTime.dwLowDateTime=0x24a09d40, ftLastAccessTime.dwHighDateTime=0x1d5d9ed, ftLastWriteTime.dwLowDateTime=0x24a09d40, ftLastWriteTime.dwHighDateTime=0x1d5d9ed, nFileSizeHigh=0x0, nFileSizeLow=0x18134, dwReserved0=0x0, dwReserved1=0x0, cFileName="6DZggA1Ty.flv", cAlternateFileName="6DZGGA~1.FLV")) returned 1 [0198.170] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0457700, ftCreationTime.dwHighDateTime=0x1d5dd3b, ftLastAccessTime.dwLowDateTime=0xede074b0, ftLastAccessTime.dwHighDateTime=0x1d5e149, ftLastWriteTime.dwLowDateTime=0xede074b0, ftLastWriteTime.dwHighDateTime=0x1d5e149, nFileSizeHigh=0x0, nFileSizeLow=0x2bde, dwReserved0=0x0, dwReserved1=0x0, cFileName="j5RouV1j7HnFN.mkv", cAlternateFileName="J5ROUV~1.MKV")) returned 1 [0198.170] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20799b00, ftCreationTime.dwHighDateTime=0x1d5e09f, ftLastAccessTime.dwLowDateTime=0xc78d7f60, ftLastAccessTime.dwHighDateTime=0x1d5e347, ftLastWriteTime.dwLowDateTime=0xc78d7f60, ftLastWriteTime.dwHighDateTime=0x1d5e347, nFileSizeHigh=0x0, nFileSizeLow=0x9f43, dwReserved0=0x0, dwReserved1=0x0, cFileName="NFagidh2b.avi", cAlternateFileName="NFAGID~1.AVI")) returned 1 [0198.170] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x291ccc50, ftCreationTime.dwHighDateTime=0x1d5dd6b, ftLastAccessTime.dwLowDateTime=0x11d73660, ftLastAccessTime.dwHighDateTime=0x1d5e2c1, ftLastWriteTime.dwLowDateTime=0x11d73660, ftLastWriteTime.dwHighDateTime=0x1d5e2c1, nFileSizeHigh=0x0, nFileSizeLow=0xd56c, dwReserved0=0x0, dwReserved1=0x0, cFileName="T9wsPG.mp4", cAlternateFileName="")) returned 1 [0198.170] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0198.170] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df304) returned 1 [0198.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df310) returned 1 [0198.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df388) returned 1 [0198.170] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN", nBufferLength=0x105, lpBuffer=0x58dee90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN", lpFilePart=0x0) returned 0x38 [0198.170] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\", nBufferLength=0x105, lpBuffer=0x58dee64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\", lpFilePart=0x0) returned 0x39 [0198.170] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\jrlzcN\\*", lpFindFileData=0x58df0b0 | out: lpFindFileData=0x58df0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a3c9270, ftCreationTime.dwHighDateTime=0x1d5df2c, ftLastAccessTime.dwLowDateTime=0x5d8bbbc0, ftLastAccessTime.dwHighDateTime=0x1d5dc0a, ftLastWriteTime.dwLowDateTime=0x5d8bbbc0, ftLastWriteTime.dwHighDateTime=0x1d5dc0a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.171] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a3c9270, ftCreationTime.dwHighDateTime=0x1d5df2c, ftLastAccessTime.dwLowDateTime=0x5d8bbbc0, ftLastAccessTime.dwHighDateTime=0x1d5dc0a, ftLastWriteTime.dwLowDateTime=0x5d8bbbc0, ftLastWriteTime.dwHighDateTime=0x1d5dc0a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.171] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x470d0b90, ftCreationTime.dwHighDateTime=0x1d5da4a, ftLastAccessTime.dwLowDateTime=0x76263b20, ftLastAccessTime.dwHighDateTime=0x1d5e74e, ftLastWriteTime.dwLowDateTime=0x76263b20, ftLastWriteTime.dwHighDateTime=0x1d5e74e, nFileSizeHigh=0x0, nFileSizeLow=0x835b, dwReserved0=0x0, dwReserved1=0x0, cFileName="fu8Lf11wf4XDZYYv.mp4", cAlternateFileName="FU8LF1~1.MP4")) returned 1 [0198.171] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6adbab0, ftCreationTime.dwHighDateTime=0x1d5e21d, ftLastAccessTime.dwLowDateTime=0x6eceb9f0, ftLastAccessTime.dwHighDateTime=0x1d5e56f, ftLastWriteTime.dwLowDateTime=0x6eceb9f0, ftLastWriteTime.dwHighDateTime=0x1d5e56f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="R5LIt1", cAlternateFileName="")) returned 1 [0198.171] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6adbab0, ftCreationTime.dwHighDateTime=0x1d5e21d, ftLastAccessTime.dwLowDateTime=0x6eceb9f0, ftLastAccessTime.dwHighDateTime=0x1d5e56f, ftLastWriteTime.dwLowDateTime=0x6eceb9f0, ftLastWriteTime.dwHighDateTime=0x1d5e56f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="R5LIt1", cAlternateFileName="")) returned 0 [0198.171] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.171] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df348) returned 1 [0198.171] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df354) returned 1 [0198.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3cc) returned 1 [0198.172] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7", nBufferLength=0x105, lpBuffer=0x58deed4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7", lpFilePart=0x0) returned 0x31 [0198.172] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\", nBufferLength=0x105, lpBuffer=0x58deea8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\", lpFilePart=0x0) returned 0x32 [0198.172] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1Xq74mC5Z6A7\\*", lpFindFileData=0x58df0f4 | out: lpFindFileData=0x58df0f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8bc769b0, ftCreationTime.dwHighDateTime=0x1d5e6f7, ftLastAccessTime.dwLowDateTime=0xdaac6e50, ftLastAccessTime.dwHighDateTime=0x1d5db39, ftLastWriteTime.dwLowDateTime=0xdaac6e50, ftLastWriteTime.dwHighDateTime=0x1d5db39, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.172] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8bc769b0, ftCreationTime.dwHighDateTime=0x1d5e6f7, ftLastAccessTime.dwLowDateTime=0xdaac6e50, ftLastAccessTime.dwHighDateTime=0x1d5db39, ftLastWriteTime.dwLowDateTime=0xdaac6e50, ftLastWriteTime.dwHighDateTime=0x1d5db39, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.172] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b0a9720, ftCreationTime.dwHighDateTime=0x1d5e290, ftLastAccessTime.dwLowDateTime=0x87d59150, ftLastAccessTime.dwHighDateTime=0x1d5d7e9, ftLastWriteTime.dwLowDateTime=0x87d59150, ftLastWriteTime.dwHighDateTime=0x1d5d7e9, nFileSizeHigh=0x0, nFileSizeLow=0x1268d, dwReserved0=0x0, dwReserved1=0x0, cFileName="bcQJ97S.flv", cAlternateFileName="")) returned 1 [0198.172] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a3c9270, ftCreationTime.dwHighDateTime=0x1d5df2c, ftLastAccessTime.dwLowDateTime=0x5d8bbbc0, ftLastAccessTime.dwHighDateTime=0x1d5dc0a, ftLastWriteTime.dwLowDateTime=0x5d8bbbc0, ftLastWriteTime.dwHighDateTime=0x1d5dc0a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jrlzcN", cAlternateFileName="")) returned 1 [0198.172] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb67e6b20, ftCreationTime.dwHighDateTime=0x1d5e4a6, ftLastAccessTime.dwLowDateTime=0x9f93d270, ftLastAccessTime.dwHighDateTime=0x1d5dad2, ftLastWriteTime.dwLowDateTime=0x9f93d270, ftLastWriteTime.dwHighDateTime=0x1d5dad2, nFileSizeHigh=0x0, nFileSizeLow=0x18ead, dwReserved0=0x0, dwReserved1=0x0, cFileName="VF-j.swf", cAlternateFileName="")) returned 1 [0198.172] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0198.173] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df38c) returned 1 [0198.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df398) returned 1 [0198.173] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\.", nBufferLength=0x105, lpBuffer=0x58deed0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5", lpFilePart=0x0) returned 0x29 [0198.173] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5", nBufferLength=0x105, lpBuffer=0x58def04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5", lpFilePart=0x0) returned 0x29 [0198.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df360) returned 1 [0198.173] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sub5"), fInfoLevelId=0x0, lpFileInformation=0x58df3dc | out: lpFileInformation=0x58df3dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb66bf550, ftCreationTime.dwHighDateTime=0x1d5dde7, ftLastAccessTime.dwLowDateTime=0xb5e8c0d0, ftLastAccessTime.dwHighDateTime=0x1d5daa0, ftLastWriteTime.dwLowDateTime=0xb5e8c0d0, ftLastWriteTime.dwHighDateTime=0x1d5daa0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0198.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df35c) returned 1 [0198.177] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5", nBufferLength=0x105, lpBuffer=0x58def04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5", lpFilePart=0x0) returned 0x29 [0198.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3cc) returned 1 [0198.178] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5", nBufferLength=0x105, lpBuffer=0x58deed4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5", lpFilePart=0x0) returned 0x29 [0198.178] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\", nBufferLength=0x105, lpBuffer=0x58deea8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\", lpFilePart=0x0) returned 0x2a [0198.178] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\*", lpFindFileData=0x58df0f4 | out: lpFindFileData=0x58df0f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb66bf550, ftCreationTime.dwHighDateTime=0x1d5dde7, ftLastAccessTime.dwLowDateTime=0xb5e8c0d0, ftLastAccessTime.dwHighDateTime=0x1d5daa0, ftLastWriteTime.dwLowDateTime=0xb5e8c0d0, ftLastWriteTime.dwHighDateTime=0x1d5daa0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.189] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb66bf550, ftCreationTime.dwHighDateTime=0x1d5dde7, ftLastAccessTime.dwLowDateTime=0xb5e8c0d0, ftLastAccessTime.dwHighDateTime=0x1d5daa0, ftLastWriteTime.dwLowDateTime=0xb5e8c0d0, ftLastWriteTime.dwHighDateTime=0x1d5daa0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.189] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0b53df0, ftCreationTime.dwHighDateTime=0x1d5e41a, ftLastAccessTime.dwLowDateTime=0xb9a9ce20, ftLastAccessTime.dwHighDateTime=0x1d5e2bc, ftLastWriteTime.dwLowDateTime=0xb9a9ce20, ftLastWriteTime.dwHighDateTime=0x1d5e2bc, nFileSizeHigh=0x0, nFileSizeLow=0xaa4, dwReserved0=0x0, dwReserved1=0x0, cFileName="E4MXu.mkv", cAlternateFileName="")) returned 1 [0198.189] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f781250, ftCreationTime.dwHighDateTime=0x1d5dbf8, ftLastAccessTime.dwLowDateTime=0xdbf43e80, ftLastAccessTime.dwHighDateTime=0x1d5e2b6, ftLastWriteTime.dwLowDateTime=0xdbf43e80, ftLastWriteTime.dwHighDateTime=0x1d5e2b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jYyk68fsWCM3V_tNvj", cAlternateFileName="JYYK68~1")) returned 1 [0198.189] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x434b1b20, ftCreationTime.dwHighDateTime=0x1d5dfe8, ftLastAccessTime.dwLowDateTime=0x7e783d20, ftLastAccessTime.dwHighDateTime=0x1d5dda1, ftLastWriteTime.dwLowDateTime=0x7e783d20, ftLastWriteTime.dwHighDateTime=0x1d5dda1, nFileSizeHigh=0x0, nFileSizeLow=0x1271b, dwReserved0=0x0, dwReserved1=0x0, cFileName="kdGBxQsdPJhaK3.mkv", cAlternateFileName="KDGBXQ~1.MKV")) returned 1 [0198.190] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61f72140, ftCreationTime.dwHighDateTime=0x1d5de30, ftLastAccessTime.dwLowDateTime=0xd800b040, ftLastAccessTime.dwHighDateTime=0x1d5dd9f, ftLastWriteTime.dwLowDateTime=0xd800b040, ftLastWriteTime.dwHighDateTime=0x1d5dd9f, nFileSizeHigh=0x0, nFileSizeLow=0x7afc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SExsjX.mkv", cAlternateFileName="")) returned 1 [0198.190] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c04bec0, ftCreationTime.dwHighDateTime=0x1d5dd98, ftLastAccessTime.dwLowDateTime=0xcee97910, ftLastAccessTime.dwHighDateTime=0x1d5e605, ftLastWriteTime.dwLowDateTime=0xcee97910, ftLastWriteTime.dwHighDateTime=0x1d5e605, nFileSizeHigh=0x0, nFileSizeLow=0x154f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="sHZA.avi", cAlternateFileName="")) returned 1 [0198.190] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c04bec0, ftCreationTime.dwHighDateTime=0x1d5dd98, ftLastAccessTime.dwLowDateTime=0xcee97910, ftLastAccessTime.dwHighDateTime=0x1d5e605, ftLastWriteTime.dwLowDateTime=0xcee97910, ftLastWriteTime.dwHighDateTime=0x1d5e605, nFileSizeHigh=0x0, nFileSizeLow=0x154f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="sHZA.avi", cAlternateFileName="")) returned 0 [0198.190] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df38c) returned 1 [0198.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df398) returned 1 [0198.191] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\jYyk68fsWCM3V_tNvj\\.", nBufferLength=0x105, lpBuffer=0x58dee8c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\jYyk68fsWCM3V_tNvj", lpFilePart=0x0) returned 0x3c [0198.191] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\jYyk68fsWCM3V_tNvj", nBufferLength=0x105, lpBuffer=0x58deec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\jYyk68fsWCM3V_tNvj", lpFilePart=0x0) returned 0x3c [0198.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df31c) returned 1 [0198.191] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\jYyk68fsWCM3V_tNvj" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sub5\\jyyk68fswcm3v_tnvj"), fInfoLevelId=0x0, lpFileInformation=0x58df398 | out: lpFileInformation=0x58df398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f781250, ftCreationTime.dwHighDateTime=0x1d5dbf8, ftLastAccessTime.dwLowDateTime=0xdbf43e80, ftLastAccessTime.dwHighDateTime=0x1d5e2b6, ftLastWriteTime.dwLowDateTime=0xdbf43e80, ftLastWriteTime.dwHighDateTime=0x1d5e2b6, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0198.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df318) returned 1 [0198.192] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\jYyk68fsWCM3V_tNvj", nBufferLength=0x105, lpBuffer=0x58deec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\jYyk68fsWCM3V_tNvj", lpFilePart=0x0) returned 0x3c [0198.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df388) returned 1 [0198.192] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\jYyk68fsWCM3V_tNvj", nBufferLength=0x105, lpBuffer=0x58dee90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\jYyk68fsWCM3V_tNvj", lpFilePart=0x0) returned 0x3c [0198.192] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\jYyk68fsWCM3V_tNvj\\", nBufferLength=0x105, lpBuffer=0x58dee64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\jYyk68fsWCM3V_tNvj\\", lpFilePart=0x0) returned 0x3d [0198.192] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\jYyk68fsWCM3V_tNvj\\*", lpFindFileData=0x58df0b0 | out: lpFindFileData=0x58df0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f781250, ftCreationTime.dwHighDateTime=0x1d5dbf8, ftLastAccessTime.dwLowDateTime=0xdbf43e80, ftLastAccessTime.dwHighDateTime=0x1d5e2b6, ftLastWriteTime.dwLowDateTime=0xdbf43e80, ftLastWriteTime.dwHighDateTime=0x1d5e2b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.192] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f781250, ftCreationTime.dwHighDateTime=0x1d5dbf8, ftLastAccessTime.dwLowDateTime=0xdbf43e80, ftLastAccessTime.dwHighDateTime=0x1d5e2b6, ftLastWriteTime.dwLowDateTime=0xdbf43e80, ftLastWriteTime.dwHighDateTime=0x1d5e2b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.193] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a68a020, ftCreationTime.dwHighDateTime=0x1d5e28f, ftLastAccessTime.dwLowDateTime=0xbd50c7f0, ftLastAccessTime.dwHighDateTime=0x1d5de9c, ftLastWriteTime.dwLowDateTime=0xbd50c7f0, ftLastWriteTime.dwHighDateTime=0x1d5de9c, nFileSizeHigh=0x0, nFileSizeLow=0x4e65, dwReserved0=0x0, dwReserved1=0x0, cFileName="SqxFtV7dupmJWSBtbws.flv", cAlternateFileName="SQXFTV~1.FLV")) returned 1 [0198.193] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde162270, ftCreationTime.dwHighDateTime=0x1d5dac6, ftLastAccessTime.dwLowDateTime=0x4937b0, ftLastAccessTime.dwHighDateTime=0x1d5e42c, ftLastWriteTime.dwLowDateTime=0x4937b0, ftLastWriteTime.dwHighDateTime=0x1d5e42c, nFileSizeHigh=0x0, nFileSizeLow=0xbd90, dwReserved0=0x0, dwReserved1=0x0, cFileName="XaYtXP MOExJDn1ZzXp.mp4", cAlternateFileName="XAYTXP~1.MP4")) returned 1 [0198.193] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde162270, ftCreationTime.dwHighDateTime=0x1d5dac6, ftLastAccessTime.dwLowDateTime=0x4937b0, ftLastAccessTime.dwHighDateTime=0x1d5e42c, ftLastWriteTime.dwLowDateTime=0x4937b0, ftLastWriteTime.dwHighDateTime=0x1d5e42c, nFileSizeHigh=0x0, nFileSizeLow=0xbd90, dwReserved0=0x0, dwReserved1=0x0, cFileName="XaYtXP MOExJDn1ZzXp.mp4", cAlternateFileName="XAYTXP~1.MP4")) returned 0 [0198.193] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df348) returned 1 [0198.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df354) returned 1 [0198.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df388) returned 1 [0198.193] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\jYyk68fsWCM3V_tNvj", nBufferLength=0x105, lpBuffer=0x58dee90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\jYyk68fsWCM3V_tNvj", lpFilePart=0x0) returned 0x3c [0198.193] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\jYyk68fsWCM3V_tNvj\\", nBufferLength=0x105, lpBuffer=0x58dee64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\jYyk68fsWCM3V_tNvj\\", lpFilePart=0x0) returned 0x3d [0198.193] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\jYyk68fsWCM3V_tNvj\\*", lpFindFileData=0x58df0b0 | out: lpFindFileData=0x58df0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f781250, ftCreationTime.dwHighDateTime=0x1d5dbf8, ftLastAccessTime.dwLowDateTime=0xdbf43e80, ftLastAccessTime.dwHighDateTime=0x1d5e2b6, ftLastWriteTime.dwLowDateTime=0xdbf43e80, ftLastWriteTime.dwHighDateTime=0x1d5e2b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.194] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f781250, ftCreationTime.dwHighDateTime=0x1d5dbf8, ftLastAccessTime.dwLowDateTime=0xdbf43e80, ftLastAccessTime.dwHighDateTime=0x1d5e2b6, ftLastWriteTime.dwLowDateTime=0xdbf43e80, ftLastWriteTime.dwHighDateTime=0x1d5e2b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.194] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a68a020, ftCreationTime.dwHighDateTime=0x1d5e28f, ftLastAccessTime.dwLowDateTime=0xbd50c7f0, ftLastAccessTime.dwHighDateTime=0x1d5de9c, ftLastWriteTime.dwLowDateTime=0xbd50c7f0, ftLastWriteTime.dwHighDateTime=0x1d5de9c, nFileSizeHigh=0x0, nFileSizeLow=0x4e65, dwReserved0=0x0, dwReserved1=0x0, cFileName="SqxFtV7dupmJWSBtbws.flv", cAlternateFileName="SQXFTV~1.FLV")) returned 1 [0198.194] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde162270, ftCreationTime.dwHighDateTime=0x1d5dac6, ftLastAccessTime.dwLowDateTime=0x4937b0, ftLastAccessTime.dwHighDateTime=0x1d5e42c, ftLastWriteTime.dwLowDateTime=0x4937b0, ftLastWriteTime.dwHighDateTime=0x1d5e42c, nFileSizeHigh=0x0, nFileSizeLow=0xbd90, dwReserved0=0x0, dwReserved1=0x0, cFileName="XaYtXP MOExJDn1ZzXp.mp4", cAlternateFileName="XAYTXP~1.MP4")) returned 1 [0198.194] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0198.194] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df348) returned 1 [0198.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df354) returned 1 [0198.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3cc) returned 1 [0198.194] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5", nBufferLength=0x105, lpBuffer=0x58deed4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5", lpFilePart=0x0) returned 0x29 [0198.194] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\", nBufferLength=0x105, lpBuffer=0x58deea8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\", lpFilePart=0x0) returned 0x2a [0198.194] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\sUB5\\*", lpFindFileData=0x58df0f4 | out: lpFindFileData=0x58df0f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb66bf550, ftCreationTime.dwHighDateTime=0x1d5dde7, ftLastAccessTime.dwLowDateTime=0xb5e8c0d0, ftLastAccessTime.dwHighDateTime=0x1d5daa0, ftLastWriteTime.dwLowDateTime=0xb5e8c0d0, ftLastWriteTime.dwHighDateTime=0x1d5daa0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.195] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb66bf550, ftCreationTime.dwHighDateTime=0x1d5dde7, ftLastAccessTime.dwLowDateTime=0xb5e8c0d0, ftLastAccessTime.dwHighDateTime=0x1d5daa0, ftLastWriteTime.dwLowDateTime=0xb5e8c0d0, ftLastWriteTime.dwHighDateTime=0x1d5daa0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.195] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0b53df0, ftCreationTime.dwHighDateTime=0x1d5e41a, ftLastAccessTime.dwLowDateTime=0xb9a9ce20, ftLastAccessTime.dwHighDateTime=0x1d5e2bc, ftLastWriteTime.dwLowDateTime=0xb9a9ce20, ftLastWriteTime.dwHighDateTime=0x1d5e2bc, nFileSizeHigh=0x0, nFileSizeLow=0xaa4, dwReserved0=0x0, dwReserved1=0x0, cFileName="E4MXu.mkv", cAlternateFileName="")) returned 1 [0198.195] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f781250, ftCreationTime.dwHighDateTime=0x1d5dbf8, ftLastAccessTime.dwLowDateTime=0xdbf43e80, ftLastAccessTime.dwHighDateTime=0x1d5e2b6, ftLastWriteTime.dwLowDateTime=0xdbf43e80, ftLastWriteTime.dwHighDateTime=0x1d5e2b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jYyk68fsWCM3V_tNvj", cAlternateFileName="JYYK68~1")) returned 1 [0198.195] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x434b1b20, ftCreationTime.dwHighDateTime=0x1d5dfe8, ftLastAccessTime.dwLowDateTime=0x7e783d20, ftLastAccessTime.dwHighDateTime=0x1d5dda1, ftLastWriteTime.dwLowDateTime=0x7e783d20, ftLastWriteTime.dwHighDateTime=0x1d5dda1, nFileSizeHigh=0x0, nFileSizeLow=0x1271b, dwReserved0=0x0, dwReserved1=0x0, cFileName="kdGBxQsdPJhaK3.mkv", cAlternateFileName="KDGBXQ~1.MKV")) returned 1 [0198.195] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61f72140, ftCreationTime.dwHighDateTime=0x1d5de30, ftLastAccessTime.dwLowDateTime=0xd800b040, ftLastAccessTime.dwHighDateTime=0x1d5dd9f, ftLastWriteTime.dwLowDateTime=0xd800b040, ftLastWriteTime.dwHighDateTime=0x1d5dd9f, nFileSizeHigh=0x0, nFileSizeLow=0x7afc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SExsjX.mkv", cAlternateFileName="")) returned 1 [0198.195] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c04bec0, ftCreationTime.dwHighDateTime=0x1d5dd98, ftLastAccessTime.dwLowDateTime=0xcee97910, ftLastAccessTime.dwHighDateTime=0x1d5e605, ftLastWriteTime.dwLowDateTime=0xcee97910, ftLastWriteTime.dwHighDateTime=0x1d5e605, nFileSizeHigh=0x0, nFileSizeLow=0x154f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="sHZA.avi", cAlternateFileName="")) returned 1 [0198.196] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0198.196] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df38c) returned 1 [0198.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df398) returned 1 [0198.196] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\.", nBufferLength=0x105, lpBuffer=0x58deed0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana", lpFilePart=0x0) returned 0x2d [0198.196] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana", nBufferLength=0x105, lpBuffer=0x58def04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana", lpFilePart=0x0) returned 0x2d [0198.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df360) returned 1 [0198.196] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\yndaxana"), fInfoLevelId=0x0, lpFileInformation=0x58df3dc | out: lpFileInformation=0x58df3dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67c14b80, ftCreationTime.dwHighDateTime=0x1d5dd79, ftLastAccessTime.dwLowDateTime=0x4065cb70, ftLastAccessTime.dwHighDateTime=0x1d5e38b, ftLastWriteTime.dwLowDateTime=0x4065cb70, ftLastWriteTime.dwHighDateTime=0x1d5e38b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0198.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df35c) returned 1 [0198.199] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana", nBufferLength=0x105, lpBuffer=0x58def04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana", lpFilePart=0x0) returned 0x2d [0198.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3cc) returned 1 [0198.199] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana", nBufferLength=0x105, lpBuffer=0x58deed4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana", lpFilePart=0x0) returned 0x2d [0198.199] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\", nBufferLength=0x105, lpBuffer=0x58deea8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\", lpFilePart=0x0) returned 0x2e [0198.199] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\*", lpFindFileData=0x58df0f4 | out: lpFindFileData=0x58df0f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67c14b80, ftCreationTime.dwHighDateTime=0x1d5dd79, ftLastAccessTime.dwLowDateTime=0x4065cb70, ftLastAccessTime.dwHighDateTime=0x1d5e38b, ftLastWriteTime.dwLowDateTime=0x4065cb70, ftLastWriteTime.dwHighDateTime=0x1d5e38b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.205] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67c14b80, ftCreationTime.dwHighDateTime=0x1d5dd79, ftLastAccessTime.dwLowDateTime=0x4065cb70, ftLastAccessTime.dwHighDateTime=0x1d5e38b, ftLastWriteTime.dwLowDateTime=0x4065cb70, ftLastWriteTime.dwHighDateTime=0x1d5e38b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.206] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c791a90, ftCreationTime.dwHighDateTime=0x1d5da81, ftLastAccessTime.dwLowDateTime=0x11a7be50, ftLastAccessTime.dwHighDateTime=0x1d5de55, ftLastWriteTime.dwLowDateTime=0x11a7be50, ftLastWriteTime.dwHighDateTime=0x1d5de55, nFileSizeHigh=0x0, nFileSizeLow=0xd928, dwReserved0=0x0, dwReserved1=0x0, cFileName="4jHEZJBZezOPue0 sTIX.flv", cAlternateFileName="4JHEZJ~1.FLV")) returned 1 [0198.206] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x632ac780, ftCreationTime.dwHighDateTime=0x1d5e48c, ftLastAccessTime.dwLowDateTime=0x13b233f0, ftLastAccessTime.dwHighDateTime=0x1d5de0b, ftLastWriteTime.dwLowDateTime=0x13b233f0, ftLastWriteTime.dwHighDateTime=0x1d5de0b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="64N32d", cAlternateFileName="")) returned 1 [0198.206] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xceaf3120, ftCreationTime.dwHighDateTime=0x1d5e1d1, ftLastAccessTime.dwLowDateTime=0xb1d4bcc0, ftLastAccessTime.dwHighDateTime=0x1d5db30, ftLastWriteTime.dwLowDateTime=0xb1d4bcc0, ftLastWriteTime.dwHighDateTime=0x1d5db30, nFileSizeHigh=0x0, nFileSizeLow=0x458d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Egf5GFS8CpmXGKA6.swf", cAlternateFileName="EGF5GF~1.SWF")) returned 1 [0198.206] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x272d5cd0, ftCreationTime.dwHighDateTime=0x1d5e418, ftLastAccessTime.dwLowDateTime=0x776fe660, ftLastAccessTime.dwHighDateTime=0x1d5e0f1, ftLastWriteTime.dwLowDateTime=0x776fe660, ftLastWriteTime.dwHighDateTime=0x1d5e0f1, nFileSizeHigh=0x0, nFileSizeLow=0x8a7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MFQpy_VaHtxqEb10.swf", cAlternateFileName="MFQPY_~1.SWF")) returned 1 [0198.206] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3106fb0, ftCreationTime.dwHighDateTime=0x1d5e7c2, ftLastAccessTime.dwLowDateTime=0x3ba9cd50, ftLastAccessTime.dwHighDateTime=0x1d5e207, ftLastWriteTime.dwLowDateTime=0x3ba9cd50, ftLastWriteTime.dwHighDateTime=0x1d5e207, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NEJg", cAlternateFileName="")) returned 1 [0198.206] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0198.206] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df38c) returned 1 [0198.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df398) returned 1 [0198.207] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\64N32d\\.", nBufferLength=0x105, lpBuffer=0x58dee8c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\64N32d", lpFilePart=0x0) returned 0x34 [0198.207] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\64N32d", nBufferLength=0x105, lpBuffer=0x58deec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\64N32d", lpFilePart=0x0) returned 0x34 [0198.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df31c) returned 1 [0198.207] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\64N32d" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\yndaxana\\64n32d"), fInfoLevelId=0x0, lpFileInformation=0x58df398 | out: lpFileInformation=0x58df398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x632ac780, ftCreationTime.dwHighDateTime=0x1d5e48c, ftLastAccessTime.dwLowDateTime=0x13b233f0, ftLastAccessTime.dwHighDateTime=0x1d5de0b, ftLastWriteTime.dwLowDateTime=0x13b233f0, ftLastWriteTime.dwHighDateTime=0x1d5de0b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0198.211] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df318) returned 1 [0198.211] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\64N32d", nBufferLength=0x105, lpBuffer=0x58deec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\64N32d", lpFilePart=0x0) returned 0x34 [0198.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df388) returned 1 [0198.211] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\64N32d", nBufferLength=0x105, lpBuffer=0x58dee90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\64N32d", lpFilePart=0x0) returned 0x34 [0198.211] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\64N32d\\", nBufferLength=0x105, lpBuffer=0x58dee64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\64N32d\\", lpFilePart=0x0) returned 0x35 [0198.211] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\64N32d\\*", lpFindFileData=0x58df0b0 | out: lpFindFileData=0x58df0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x632ac780, ftCreationTime.dwHighDateTime=0x1d5e48c, ftLastAccessTime.dwLowDateTime=0x13b233f0, ftLastAccessTime.dwHighDateTime=0x1d5de0b, ftLastWriteTime.dwLowDateTime=0x13b233f0, ftLastWriteTime.dwHighDateTime=0x1d5de0b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.300] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x632ac780, ftCreationTime.dwHighDateTime=0x1d5e48c, ftLastAccessTime.dwLowDateTime=0x13b233f0, ftLastAccessTime.dwHighDateTime=0x1d5de0b, ftLastWriteTime.dwLowDateTime=0x13b233f0, ftLastWriteTime.dwHighDateTime=0x1d5de0b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.301] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff2618a0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x8a5e5bf0, ftLastAccessTime.dwHighDateTime=0x1d5d992, ftLastWriteTime.dwLowDateTime=0x8a5e5bf0, ftLastWriteTime.dwHighDateTime=0x1d5d992, nFileSizeHigh=0x0, nFileSizeLow=0x15ebe, dwReserved0=0x0, dwReserved1=0x0, cFileName="aijo4jBqwJrSLrg.flv", cAlternateFileName="AIJO4J~1.FLV")) returned 1 [0198.301] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d7d09b0, ftCreationTime.dwHighDateTime=0x1d5ddee, ftLastAccessTime.dwLowDateTime=0xf44bd300, ftLastAccessTime.dwHighDateTime=0x1d5e3ea, ftLastWriteTime.dwLowDateTime=0xf44bd300, ftLastWriteTime.dwHighDateTime=0x1d5e3ea, nFileSizeHigh=0x0, nFileSizeLow=0x4243, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hb30BdSPFe8NaExh.mkv", cAlternateFileName="HB30BD~1.MKV")) returned 1 [0198.301] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88b8d860, ftCreationTime.dwHighDateTime=0x1d5e5be, ftLastAccessTime.dwLowDateTime=0xbcf96cc0, ftLastAccessTime.dwHighDateTime=0x1d5e4c9, ftLastWriteTime.dwLowDateTime=0xbcf96cc0, ftLastWriteTime.dwHighDateTime=0x1d5e4c9, nFileSizeHigh=0x0, nFileSizeLow=0x1bcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="iwRGDoe8gG2XUv_Yl.swf", cAlternateFileName="IWRGDO~1.SWF")) returned 1 [0198.301] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5928fd10, ftCreationTime.dwHighDateTime=0x1d5e38d, ftLastAccessTime.dwLowDateTime=0xed43c940, ftLastAccessTime.dwHighDateTime=0x1d5df09, ftLastWriteTime.dwLowDateTime=0xed43c940, ftLastWriteTime.dwHighDateTime=0x1d5df09, nFileSizeHigh=0x0, nFileSizeLow=0x7060, dwReserved0=0x0, dwReserved1=0x0, cFileName="QbvMtNh4lRDdZhND797.avi", cAlternateFileName="QBVMTN~1.AVI")) returned 1 [0198.301] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5928fd10, ftCreationTime.dwHighDateTime=0x1d5e38d, ftLastAccessTime.dwLowDateTime=0xed43c940, ftLastAccessTime.dwHighDateTime=0x1d5df09, ftLastWriteTime.dwLowDateTime=0xed43c940, ftLastWriteTime.dwHighDateTime=0x1d5df09, nFileSizeHigh=0x0, nFileSizeLow=0x7060, dwReserved0=0x0, dwReserved1=0x0, cFileName="QbvMtNh4lRDdZhND797.avi", cAlternateFileName="QBVMTN~1.AVI")) returned 0 [0198.302] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df348) returned 1 [0198.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df354) returned 1 [0198.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df388) returned 1 [0198.303] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\64N32d", nBufferLength=0x105, lpBuffer=0x58dee90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\64N32d", lpFilePart=0x0) returned 0x34 [0198.303] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\64N32d\\", nBufferLength=0x105, lpBuffer=0x58dee64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\64N32d\\", lpFilePart=0x0) returned 0x35 [0198.303] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\64N32d\\*", lpFindFileData=0x58df0b0 | out: lpFindFileData=0x58df0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x632ac780, ftCreationTime.dwHighDateTime=0x1d5e48c, ftLastAccessTime.dwLowDateTime=0x13b233f0, ftLastAccessTime.dwHighDateTime=0x1d5de0b, ftLastWriteTime.dwLowDateTime=0x13b233f0, ftLastWriteTime.dwHighDateTime=0x1d5de0b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.304] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x632ac780, ftCreationTime.dwHighDateTime=0x1d5e48c, ftLastAccessTime.dwLowDateTime=0x13b233f0, ftLastAccessTime.dwHighDateTime=0x1d5de0b, ftLastWriteTime.dwLowDateTime=0x13b233f0, ftLastWriteTime.dwHighDateTime=0x1d5de0b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.304] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff2618a0, ftCreationTime.dwHighDateTime=0x1d5e1b3, ftLastAccessTime.dwLowDateTime=0x8a5e5bf0, ftLastAccessTime.dwHighDateTime=0x1d5d992, ftLastWriteTime.dwLowDateTime=0x8a5e5bf0, ftLastWriteTime.dwHighDateTime=0x1d5d992, nFileSizeHigh=0x0, nFileSizeLow=0x15ebe, dwReserved0=0x0, dwReserved1=0x0, cFileName="aijo4jBqwJrSLrg.flv", cAlternateFileName="AIJO4J~1.FLV")) returned 1 [0198.304] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d7d09b0, ftCreationTime.dwHighDateTime=0x1d5ddee, ftLastAccessTime.dwLowDateTime=0xf44bd300, ftLastAccessTime.dwHighDateTime=0x1d5e3ea, ftLastWriteTime.dwLowDateTime=0xf44bd300, ftLastWriteTime.dwHighDateTime=0x1d5e3ea, nFileSizeHigh=0x0, nFileSizeLow=0x4243, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hb30BdSPFe8NaExh.mkv", cAlternateFileName="HB30BD~1.MKV")) returned 1 [0198.305] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88b8d860, ftCreationTime.dwHighDateTime=0x1d5e5be, ftLastAccessTime.dwLowDateTime=0xbcf96cc0, ftLastAccessTime.dwHighDateTime=0x1d5e4c9, ftLastWriteTime.dwLowDateTime=0xbcf96cc0, ftLastWriteTime.dwHighDateTime=0x1d5e4c9, nFileSizeHigh=0x0, nFileSizeLow=0x1bcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="iwRGDoe8gG2XUv_Yl.swf", cAlternateFileName="IWRGDO~1.SWF")) returned 1 [0198.305] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5928fd10, ftCreationTime.dwHighDateTime=0x1d5e38d, ftLastAccessTime.dwLowDateTime=0xed43c940, ftLastAccessTime.dwHighDateTime=0x1d5df09, ftLastWriteTime.dwLowDateTime=0xed43c940, ftLastWriteTime.dwHighDateTime=0x1d5df09, nFileSizeHigh=0x0, nFileSizeLow=0x7060, dwReserved0=0x0, dwReserved1=0x0, cFileName="QbvMtNh4lRDdZhND797.avi", cAlternateFileName="QBVMTN~1.AVI")) returned 1 [0198.305] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0198.305] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df348) returned 1 [0198.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df354) returned 1 [0198.306] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\NEJg\\.", nBufferLength=0x105, lpBuffer=0x58dee8c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\NEJg", lpFilePart=0x0) returned 0x32 [0198.306] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\NEJg", nBufferLength=0x105, lpBuffer=0x58deec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\NEJg", lpFilePart=0x0) returned 0x32 [0198.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df31c) returned 1 [0198.306] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\NEJg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\yndaxana\\nejg"), fInfoLevelId=0x0, lpFileInformation=0x58df398 | out: lpFileInformation=0x58df398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3106fb0, ftCreationTime.dwHighDateTime=0x1d5e7c2, ftLastAccessTime.dwLowDateTime=0x3ba9cd50, ftLastAccessTime.dwHighDateTime=0x1d5e207, ftLastWriteTime.dwLowDateTime=0x3ba9cd50, ftLastWriteTime.dwHighDateTime=0x1d5e207, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0198.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df318) returned 1 [0198.316] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\NEJg", nBufferLength=0x105, lpBuffer=0x58deec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\NEJg", lpFilePart=0x0) returned 0x32 [0198.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df388) returned 1 [0198.317] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\NEJg", nBufferLength=0x105, lpBuffer=0x58dee90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\NEJg", lpFilePart=0x0) returned 0x32 [0198.317] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\NEJg\\", nBufferLength=0x105, lpBuffer=0x58dee64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\NEJg\\", lpFilePart=0x0) returned 0x33 [0198.317] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\NEJg\\*", lpFindFileData=0x58df0b0 | out: lpFindFileData=0x58df0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3106fb0, ftCreationTime.dwHighDateTime=0x1d5e7c2, ftLastAccessTime.dwLowDateTime=0x3ba9cd50, ftLastAccessTime.dwHighDateTime=0x1d5e207, ftLastWriteTime.dwLowDateTime=0x3ba9cd50, ftLastWriteTime.dwHighDateTime=0x1d5e207, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.317] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3106fb0, ftCreationTime.dwHighDateTime=0x1d5e7c2, ftLastAccessTime.dwLowDateTime=0x3ba9cd50, ftLastAccessTime.dwHighDateTime=0x1d5e207, ftLastWriteTime.dwLowDateTime=0x3ba9cd50, ftLastWriteTime.dwHighDateTime=0x1d5e207, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.317] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7910a2b0, ftCreationTime.dwHighDateTime=0x1d5ddff, ftLastAccessTime.dwLowDateTime=0x7e8b30d0, ftLastAccessTime.dwHighDateTime=0x1d5d92b, ftLastWriteTime.dwLowDateTime=0x7e8b30d0, ftLastWriteTime.dwHighDateTime=0x1d5d92b, nFileSizeHigh=0x0, nFileSizeLow=0xf349, dwReserved0=0x0, dwReserved1=0x0, cFileName="7F6Iph4PnCV9Qug.swf", cAlternateFileName="7F6IPH~1.SWF")) returned 1 [0198.317] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25e0a5f0, ftCreationTime.dwHighDateTime=0x1d5d8fe, ftLastAccessTime.dwLowDateTime=0x89371c60, ftLastAccessTime.dwHighDateTime=0x1d5dc37, ftLastWriteTime.dwLowDateTime=0x89371c60, ftLastWriteTime.dwHighDateTime=0x1d5dc37, nFileSizeHigh=0x0, nFileSizeLow=0xcdc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="m1xg5305C6mxNxFxTi.mp4", cAlternateFileName="M1XG53~1.MP4")) returned 1 [0198.318] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25e0a5f0, ftCreationTime.dwHighDateTime=0x1d5d8fe, ftLastAccessTime.dwLowDateTime=0x89371c60, ftLastAccessTime.dwHighDateTime=0x1d5dc37, ftLastWriteTime.dwLowDateTime=0x89371c60, ftLastWriteTime.dwHighDateTime=0x1d5dc37, nFileSizeHigh=0x0, nFileSizeLow=0xcdc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="m1xg5305C6mxNxFxTi.mp4", cAlternateFileName="M1XG53~1.MP4")) returned 0 [0198.318] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df348) returned 1 [0198.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df354) returned 1 [0198.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df388) returned 1 [0198.318] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\NEJg", nBufferLength=0x105, lpBuffer=0x58dee90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\NEJg", lpFilePart=0x0) returned 0x32 [0198.318] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\NEJg\\", nBufferLength=0x105, lpBuffer=0x58dee64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\NEJg\\", lpFilePart=0x0) returned 0x33 [0198.318] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\NEJg\\*", lpFindFileData=0x58df0b0 | out: lpFindFileData=0x58df0b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3106fb0, ftCreationTime.dwHighDateTime=0x1d5e7c2, ftLastAccessTime.dwLowDateTime=0x3ba9cd50, ftLastAccessTime.dwHighDateTime=0x1d5e207, ftLastWriteTime.dwLowDateTime=0x3ba9cd50, ftLastWriteTime.dwHighDateTime=0x1d5e207, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.318] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3106fb0, ftCreationTime.dwHighDateTime=0x1d5e7c2, ftLastAccessTime.dwLowDateTime=0x3ba9cd50, ftLastAccessTime.dwHighDateTime=0x1d5e207, ftLastWriteTime.dwLowDateTime=0x3ba9cd50, ftLastWriteTime.dwHighDateTime=0x1d5e207, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.319] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7910a2b0, ftCreationTime.dwHighDateTime=0x1d5ddff, ftLastAccessTime.dwLowDateTime=0x7e8b30d0, ftLastAccessTime.dwHighDateTime=0x1d5d92b, ftLastWriteTime.dwLowDateTime=0x7e8b30d0, ftLastWriteTime.dwHighDateTime=0x1d5d92b, nFileSizeHigh=0x0, nFileSizeLow=0xf349, dwReserved0=0x0, dwReserved1=0x0, cFileName="7F6Iph4PnCV9Qug.swf", cAlternateFileName="7F6IPH~1.SWF")) returned 1 [0198.319] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25e0a5f0, ftCreationTime.dwHighDateTime=0x1d5d8fe, ftLastAccessTime.dwLowDateTime=0x89371c60, ftLastAccessTime.dwHighDateTime=0x1d5dc37, ftLastWriteTime.dwLowDateTime=0x89371c60, ftLastWriteTime.dwHighDateTime=0x1d5dc37, nFileSizeHigh=0x0, nFileSizeLow=0xcdc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="m1xg5305C6mxNxFxTi.mp4", cAlternateFileName="M1XG53~1.MP4")) returned 1 [0198.319] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0198.319] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df348) returned 1 [0198.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df354) returned 1 [0198.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3cc) returned 1 [0198.320] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana", nBufferLength=0x105, lpBuffer=0x58deed4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana", lpFilePart=0x0) returned 0x2d [0198.320] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\", nBufferLength=0x105, lpBuffer=0x58deea8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\", lpFilePart=0x0) returned 0x2e [0198.320] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\yndAXana\\*", lpFindFileData=0x58df0f4 | out: lpFindFileData=0x58df0f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67c14b80, ftCreationTime.dwHighDateTime=0x1d5dd79, ftLastAccessTime.dwLowDateTime=0x4065cb70, ftLastAccessTime.dwHighDateTime=0x1d5e38b, ftLastWriteTime.dwLowDateTime=0x4065cb70, ftLastWriteTime.dwHighDateTime=0x1d5e38b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.320] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67c14b80, ftCreationTime.dwHighDateTime=0x1d5dd79, ftLastAccessTime.dwLowDateTime=0x4065cb70, ftLastAccessTime.dwHighDateTime=0x1d5e38b, ftLastWriteTime.dwLowDateTime=0x4065cb70, ftLastWriteTime.dwHighDateTime=0x1d5e38b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.320] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c791a90, ftCreationTime.dwHighDateTime=0x1d5da81, ftLastAccessTime.dwLowDateTime=0x11a7be50, ftLastAccessTime.dwHighDateTime=0x1d5de55, ftLastWriteTime.dwLowDateTime=0x11a7be50, ftLastWriteTime.dwHighDateTime=0x1d5de55, nFileSizeHigh=0x0, nFileSizeLow=0xd928, dwReserved0=0x0, dwReserved1=0x0, cFileName="4jHEZJBZezOPue0 sTIX.flv", cAlternateFileName="4JHEZJ~1.FLV")) returned 1 [0198.320] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x632ac780, ftCreationTime.dwHighDateTime=0x1d5e48c, ftLastAccessTime.dwLowDateTime=0x13b233f0, ftLastAccessTime.dwHighDateTime=0x1d5de0b, ftLastWriteTime.dwLowDateTime=0x13b233f0, ftLastWriteTime.dwHighDateTime=0x1d5de0b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="64N32d", cAlternateFileName="")) returned 1 [0198.321] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xceaf3120, ftCreationTime.dwHighDateTime=0x1d5e1d1, ftLastAccessTime.dwLowDateTime=0xb1d4bcc0, ftLastAccessTime.dwHighDateTime=0x1d5db30, ftLastWriteTime.dwLowDateTime=0xb1d4bcc0, ftLastWriteTime.dwHighDateTime=0x1d5db30, nFileSizeHigh=0x0, nFileSizeLow=0x458d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Egf5GFS8CpmXGKA6.swf", cAlternateFileName="EGF5GF~1.SWF")) returned 1 [0198.321] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x272d5cd0, ftCreationTime.dwHighDateTime=0x1d5e418, ftLastAccessTime.dwLowDateTime=0x776fe660, ftLastAccessTime.dwHighDateTime=0x1d5e0f1, ftLastWriteTime.dwLowDateTime=0x776fe660, ftLastWriteTime.dwHighDateTime=0x1d5e0f1, nFileSizeHigh=0x0, nFileSizeLow=0x8a7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MFQpy_VaHtxqEb10.swf", cAlternateFileName="MFQPY_~1.SWF")) returned 1 [0198.321] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3106fb0, ftCreationTime.dwHighDateTime=0x1d5e7c2, ftLastAccessTime.dwLowDateTime=0x3ba9cd50, ftLastAccessTime.dwHighDateTime=0x1d5e207, ftLastWriteTime.dwLowDateTime=0x3ba9cd50, ftLastWriteTime.dwHighDateTime=0x1d5e207, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NEJg", cAlternateFileName="")) returned 1 [0198.321] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3106fb0, ftCreationTime.dwHighDateTime=0x1d5e7c2, ftLastAccessTime.dwLowDateTime=0x3ba9cd50, ftLastAccessTime.dwHighDateTime=0x1d5e207, ftLastWriteTime.dwLowDateTime=0x3ba9cd50, ftLastWriteTime.dwHighDateTime=0x1d5e207, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NEJg", cAlternateFileName="")) returned 0 [0198.321] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df38c) returned 1 [0198.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df398) returned 1 [0198.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df410) returned 1 [0198.329] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos", nBufferLength=0x105, lpBuffer=0x58def18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos", lpFilePart=0x0) returned 0x24 [0198.329] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\", nBufferLength=0x105, lpBuffer=0x58deeec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\", lpFilePart=0x0) returned 0x25 [0198.329] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\*", lpFindFileData=0x58df138 | out: lpFindFileData=0x58df138*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdbf11ce0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf11ce0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.329] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdbf11ce0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf11ce0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.329] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8bc769b0, ftCreationTime.dwHighDateTime=0x1d5e6f7, ftLastAccessTime.dwLowDateTime=0xdaac6e50, ftLastAccessTime.dwHighDateTime=0x1d5db39, ftLastWriteTime.dwLowDateTime=0xdaac6e50, ftLastWriteTime.dwHighDateTime=0x1d5db39, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1Xq74mC5Z6A7", cAlternateFileName="1XQ74M~1")) returned 1 [0198.330] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f0f6890, ftCreationTime.dwHighDateTime=0x1d5de6e, ftLastAccessTime.dwLowDateTime=0xc0915950, ftLastAccessTime.dwHighDateTime=0x1d5e0d3, ftLastWriteTime.dwLowDateTime=0xc0915950, ftLastWriteTime.dwHighDateTime=0x1d5e0d3, nFileSizeHigh=0x0, nFileSizeLow=0xa1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="AKpjDRBtV4E.flv", cAlternateFileName="AKPJDR~1.FLV")) returned 1 [0198.330] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0198.330] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x370dc2f0, ftCreationTime.dwHighDateTime=0x1d5e136, ftLastAccessTime.dwLowDateTime=0x6c325100, ftLastAccessTime.dwHighDateTime=0x1d5d9e6, ftLastWriteTime.dwLowDateTime=0x6c325100, ftLastWriteTime.dwHighDateTime=0x1d5d9e6, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="iz6YTcyqH6vys1VH.mp4", cAlternateFileName="IZ6YTC~1.MP4")) returned 1 [0198.330] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb66bf550, ftCreationTime.dwHighDateTime=0x1d5dde7, ftLastAccessTime.dwLowDateTime=0xb5e8c0d0, ftLastAccessTime.dwHighDateTime=0x1d5daa0, ftLastWriteTime.dwLowDateTime=0xb5e8c0d0, ftLastWriteTime.dwHighDateTime=0x1d5daa0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sUB5", cAlternateFileName="")) returned 1 [0198.330] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5e489d0, ftCreationTime.dwHighDateTime=0x1d5e6a8, ftLastAccessTime.dwLowDateTime=0x5db58210, ftLastAccessTime.dwHighDateTime=0x1d5e3e5, ftLastWriteTime.dwLowDateTime=0x5db58210, ftLastWriteTime.dwHighDateTime=0x1d5e3e5, nFileSizeHigh=0x0, nFileSizeLow=0x4735, dwReserved0=0x0, dwReserved1=0x0, cFileName="t1Wr.flv", cAlternateFileName="")) returned 1 [0198.330] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67c14b80, ftCreationTime.dwHighDateTime=0x1d5dd79, ftLastAccessTime.dwLowDateTime=0x4065cb70, ftLastAccessTime.dwHighDateTime=0x1d5e38b, ftLastWriteTime.dwLowDateTime=0x4065cb70, ftLastWriteTime.dwHighDateTime=0x1d5e38b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="yndAXana", cAlternateFileName="")) returned 1 [0198.330] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67c14b80, ftCreationTime.dwHighDateTime=0x1d5dd79, ftLastAccessTime.dwLowDateTime=0x4065cb70, ftLastAccessTime.dwHighDateTime=0x1d5e38b, ftLastWriteTime.dwLowDateTime=0x4065cb70, ftLastWriteTime.dwHighDateTime=0x1d5e38b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="yndAXana", cAlternateFileName="")) returned 0 [0198.331] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3d0) returned 1 [0198.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3dc) returned 1 [0198.331] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos", nBufferLength=0x105, lpBuffer=0x58def7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos", lpFilePart=0x0) returned 0x24 [0198.331] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x58dee1c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0198.331] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Videos.txt", nBufferLength=0x105, lpBuffer=0x58dee30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Videos.txt", lpFilePart=0x0) returned 0x82 [0198.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df324) returned 1 [0198.332] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Videos.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs\\videos.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x4b0 [0198.332] GetFileType (hFile=0x4b0) returned 0x1 [0198.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df320) returned 1 [0198.332] GetFileType (hFile=0x4b0) returned 0x1 [0198.332] WriteFile (in: hFile=0x4b0, lpBuffer=0x2507928*, nNumberOfBytesToWrite=0x2cc, lpNumberOfBytesWritten=0x58df3bc, lpOverlapped=0x0 | out: lpBuffer=0x2507928*, lpNumberOfBytesWritten=0x58df3bc*=0x2cc, lpOverlapped=0x0) returned 1 [0198.333] CloseHandle (hObject=0x4b0) returned 1 [0198.334] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", nBufferLength=0x105, lpBuffer=0x58def48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpFilePart=0x0) returned 0x5b [0198.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3a4) returned 1 [0198.334] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup"), fInfoLevelId=0x0, lpFileInformation=0x58df420 | out: lpFileInformation=0x58df420*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xeebaf170, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xeebaf170, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0198.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3a0) returned 1 [0198.334] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", nBufferLength=0x105, lpBuffer=0x58def48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpFilePart=0x0) returned 0x5b [0198.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df410) returned 1 [0198.334] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", nBufferLength=0x105, lpBuffer=0x58def18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpFilePart=0x0) returned 0x5b [0198.334] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", nBufferLength=0x105, lpBuffer=0x58deeec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", lpFilePart=0x0) returned 0x5c [0198.334] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", lpFindFileData=0x58df138 | out: lpFindFileData=0x58df138*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xeebaf170, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xeebaf170, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.335] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xeebaf170, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xeebaf170, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.335] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebaf170, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xeebaf170, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0x9cefe300, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x223200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Chrome updaters.exe", cAlternateFileName="CHROME~1.EXE")) returned 1 [0198.335] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0198.335] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0198.335] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3d0) returned 1 [0198.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3dc) returned 1 [0198.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df410) returned 1 [0198.335] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", nBufferLength=0x105, lpBuffer=0x58def18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpFilePart=0x0) returned 0x5b [0198.336] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", nBufferLength=0x105, lpBuffer=0x58deeec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", lpFilePart=0x0) returned 0x5c [0198.336] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", lpFindFileData=0x58df138 | out: lpFindFileData=0x58df138*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xeebaf170, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xeebaf170, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.336] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xeebaf170, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xeebaf170, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.336] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebaf170, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xeebaf170, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0x9cefe300, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x223200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Chrome updaters.exe", cAlternateFileName="CHROME~1.EXE")) returned 1 [0198.336] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0198.336] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0198.337] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3d0) returned 1 [0198.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3dc) returned 1 [0198.337] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", nBufferLength=0x105, lpBuffer=0x58def7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpFilePart=0x0) returned 0x5b [0198.337] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x58dee1c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0198.338] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Startup.txt", nBufferLength=0x105, lpBuffer=0x58dee30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Startup.txt", lpFilePart=0x0) returned 0x83 [0198.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df324) returned 1 [0198.338] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Startup.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs\\startup.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x4b0 [0198.338] GetFileType (hFile=0x4b0) returned 0x1 [0198.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df320) returned 1 [0198.338] GetFileType (hFile=0x4b0) returned 0x1 [0198.338] WriteFile (in: hFile=0x4b0, lpBuffer=0x250cf08*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x58df3bc, lpOverlapped=0x0 | out: lpBuffer=0x250cf08*, lpNumberOfBytesWritten=0x58df3bc*=0x2e, lpOverlapped=0x0) returned 1 [0198.340] CloseHandle (hObject=0x4b0) returned 1 [0198.340] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads", nBufferLength=0x105, lpBuffer=0x58def48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads", lpFilePart=0x0) returned 0x27 [0198.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3a4) returned 1 [0198.340] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads"), fInfoLevelId=0x0, lpFileInformation=0x58df420 | out: lpFileInformation=0x58df420*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0198.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3a0) returned 1 [0198.340] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads", nBufferLength=0x105, lpBuffer=0x58def48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads", lpFilePart=0x0) returned 0x27 [0198.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df410) returned 1 [0198.340] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads", nBufferLength=0x105, lpBuffer=0x58def18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads", lpFilePart=0x0) returned 0x27 [0198.340] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\", nBufferLength=0x105, lpBuffer=0x58deeec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\", lpFilePart=0x0) returned 0x28 [0198.341] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*", lpFindFileData=0x58df138 | out: lpFindFileData=0x58df138*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.341] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.341] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0198.341] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0198.341] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3d0) returned 1 [0198.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3dc) returned 1 [0198.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df410) returned 1 [0198.342] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads", nBufferLength=0x105, lpBuffer=0x58def18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads", lpFilePart=0x0) returned 0x27 [0198.342] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\", nBufferLength=0x105, lpBuffer=0x58deeec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\", lpFilePart=0x0) returned 0x28 [0198.342] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*", lpFindFileData=0x58df138 | out: lpFindFileData=0x58df138*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.342] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.342] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0198.342] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0198.342] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3d0) returned 1 [0198.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3dc) returned 1 [0198.343] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads", nBufferLength=0x105, lpBuffer=0x58def7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads", lpFilePart=0x0) returned 0x27 [0198.343] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x58dee1c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0198.343] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Downloads.txt", nBufferLength=0x105, lpBuffer=0x58dee30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Downloads.txt", lpFilePart=0x0) returned 0x85 [0198.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df324) returned 1 [0198.343] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Downloads.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs\\downloads.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x4b0 [0198.350] GetFileType (hFile=0x4b0) returned 0x1 [0198.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df320) returned 1 [0198.350] GetFileType (hFile=0x4b0) returned 0x1 [0198.351] WriteFile (in: hFile=0x4b0, lpBuffer=0x2510f44*, nNumberOfBytesToWrite=0x1a, lpNumberOfBytesWritten=0x58df3bc, lpOverlapped=0x0 | out: lpBuffer=0x2510f44*, lpNumberOfBytesWritten=0x58df3bc*=0x1a, lpOverlapped=0x0) returned 1 [0198.352] CloseHandle (hObject=0x4b0) returned 1 [0198.352] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Dropbox", nBufferLength=0x105, lpBuffer=0x58def48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Dropbox", lpFilePart=0x0) returned 0x25 [0198.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3a4) returned 1 [0198.352] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Dropbox" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\dropbox"), fInfoLevelId=0x0, lpFileInformation=0x58df420 | out: lpFileInformation=0x58df420*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0198.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3a0) returned 1 [0198.353] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Dropbox", nBufferLength=0x105, lpBuffer=0x58def7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Dropbox", lpFilePart=0x0) returned 0x25 [0198.353] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\OneDrive", nBufferLength=0x105, lpBuffer=0x58def48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\OneDrive", lpFilePart=0x0) returned 0x26 [0198.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3a4) returned 1 [0198.353] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\OneDrive" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\onedrive"), fInfoLevelId=0x0, lpFileInformation=0x58df420 | out: lpFileInformation=0x58df420*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0198.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3a0) returned 1 [0198.353] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\OneDrive", nBufferLength=0x105, lpBuffer=0x58def7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\OneDrive", lpFilePart=0x0) returned 0x26 [0198.353] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x58def34, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0198.354] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x58def48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x30 [0198.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3a4) returned 1 [0198.354] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp"), fInfoLevelId=0x0, lpFileInformation=0x58df420 | out: lpFileInformation=0x58df420*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x35fc1fa0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x35fc1fa0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x10000)) returned 1 [0198.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3a0) returned 1 [0198.354] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x58def34, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0198.354] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x58def48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x30 [0198.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df410) returned 1 [0198.354] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x58def18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x30 [0198.355] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x58deeec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x31 [0198.355] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\*", lpFindFileData=0x58df138 | out: lpFindFileData=0x58df138*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x35fc1fa0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x35fc1fa0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.355] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x35fc1fa0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x35fc1fa0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.358] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x513882c0, ftCreationTime.dwHighDateTime=0x1d5e639, ftLastAccessTime.dwLowDateTime=0xa93da3d0, ftLastAccessTime.dwHighDateTime=0x1d5e25e, ftLastWriteTime.dwLowDateTime=0xa93da3d0, ftLastWriteTime.dwHighDateTime=0x1d5e25e, nFileSizeHigh=0x0, nFileSizeLow=0x33f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="2Z8kQwlSPW.avi", cAlternateFileName="2Z8KQW~1.AVI")) returned 1 [0198.359] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8aa26310, ftCreationTime.dwHighDateTime=0x1d5e304, ftLastAccessTime.dwLowDateTime=0x68df32d0, ftLastAccessTime.dwHighDateTime=0x1d5e575, ftLastWriteTime.dwLowDateTime=0x68df32d0, ftLastWriteTime.dwHighDateTime=0x1d5e575, nFileSizeHigh=0x0, nFileSizeLow=0x1778a, dwReserved0=0x0, dwReserved1=0x0, cFileName="4 gCmsKJ4.odp", cAlternateFileName="4GCMSK~1.ODP")) returned 1 [0198.359] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x88265730, ftCreationTime.dwHighDateTime=0x1d5dc0c, ftLastAccessTime.dwLowDateTime=0xf362d1d0, ftLastAccessTime.dwHighDateTime=0x1d5d992, ftLastWriteTime.dwLowDateTime=0xf362d1d0, ftLastWriteTime.dwHighDateTime=0x1d5d992, nFileSizeHigh=0x0, nFileSizeLow=0x3902, dwReserved0=0x0, dwReserved1=0x0, cFileName="5-au8sTR_DKW.bmp", cAlternateFileName="5-AU8S~1.BMP")) returned 1 [0198.359] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84e753a0, ftCreationTime.dwHighDateTime=0x1d5e5e2, ftLastAccessTime.dwLowDateTime=0x45006620, ftLastAccessTime.dwHighDateTime=0x1d5da5f, ftLastWriteTime.dwLowDateTime=0x45006620, ftLastWriteTime.dwHighDateTime=0x1d5da5f, nFileSizeHigh=0x0, nFileSizeLow=0x350e, dwReserved0=0x0, dwReserved1=0x0, cFileName="57qTz_2cSF05D7BsCcc.pps", cAlternateFileName="57QTZ_~1.PPS")) returned 1 [0198.359] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe0cff6c0, ftCreationTime.dwHighDateTime=0x1d5e062, ftLastAccessTime.dwLowDateTime=0xb986d250, ftLastAccessTime.dwHighDateTime=0x1d5e6d9, ftLastWriteTime.dwLowDateTime=0xb986d250, ftLastWriteTime.dwHighDateTime=0x1d5e6d9, nFileSizeHigh=0x0, nFileSizeLow=0x5964, dwReserved0=0x0, dwReserved1=0x0, cFileName="6o74G.mp3", cAlternateFileName="")) returned 1 [0198.359] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe58ff980, ftCreationTime.dwHighDateTime=0x1d5dee6, ftLastAccessTime.dwLowDateTime=0x73d64b0, ftLastAccessTime.dwHighDateTime=0x1d5dfe0, ftLastWriteTime.dwLowDateTime=0x73d64b0, ftLastWriteTime.dwHighDateTime=0x1d5dfe0, nFileSizeHigh=0x0, nFileSizeLow=0x100fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="7OhdXa3ktL4-VE8Up.mkv", cAlternateFileName="7OHDXA~1.MKV")) returned 1 [0198.360] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf3e40c90, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf3e40c90, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9df274b54410817b3690312b4cb55431", cAlternateFileName="9DF274~1")) returned 1 [0198.360] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a0318e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x6a0318e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x32d9b1c0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x900, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeARM.log", cAlternateFileName="")) returned 1 [0198.360] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6be9bb00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x6be9bb00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x6be9bb00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bst449D.tmp", cAlternateFileName="")) returned 1 [0198.360] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5ca50, ftCreationTime.dwHighDateTime=0x1d5d89c, ftLastAccessTime.dwLowDateTime=0x6b882ea0, ftLastAccessTime.dwHighDateTime=0x1d5e729, ftLastWriteTime.dwLowDateTime=0x6b882ea0, ftLastWriteTime.dwHighDateTime=0x1d5e729, nFileSizeHigh=0x0, nFileSizeLow=0x3641, dwReserved0=0x0, dwReserved1=0x0, cFileName="BXPtYk9CKQNZ.bmp", cAlternateFileName="BXPTYK~1.BMP")) returned 1 [0198.361] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0198.361] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7adf8600, ftCreationTime.dwHighDateTime=0x1d5e012, ftLastAccessTime.dwLowDateTime=0xda8116a0, ftLastAccessTime.dwHighDateTime=0x1d5e44f, ftLastWriteTime.dwLowDateTime=0xda8116a0, ftLastWriteTime.dwHighDateTime=0x1d5e44f, nFileSizeHigh=0x0, nFileSizeLow=0x17a7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="d_9fzjXN59RtsG6FF.wav", cAlternateFileName="D_9FZJ~1.WAV")) returned 1 [0198.361] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa53eae00, ftCreationTime.dwHighDateTime=0x1d5e786, ftLastAccessTime.dwLowDateTime=0xb4ad3980, ftLastAccessTime.dwHighDateTime=0x1d5e4e6, ftLastWriteTime.dwLowDateTime=0xb4ad3980, ftLastWriteTime.dwHighDateTime=0x1d5e4e6, nFileSizeHigh=0x0, nFileSizeLow=0x309d, dwReserved0=0x0, dwReserved1=0x0, cFileName="EJsyP17Z.csv", cAlternateFileName="")) returned 1 [0198.361] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb84a230, ftCreationTime.dwHighDateTime=0x1d5de96, ftLastAccessTime.dwLowDateTime=0x91f8d5a0, ftLastAccessTime.dwHighDateTime=0x1d5e49d, ftLastWriteTime.dwLowDateTime=0x91f8d5a0, ftLastWriteTime.dwHighDateTime=0x1d5e49d, nFileSizeHigh=0x0, nFileSizeLow=0x51a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="F1_TNQKi1ckgpfT.docx", cAlternateFileName="F1_TNQ~1.DOC")) returned 1 [0198.361] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33d9ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x33d9ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FXSAPIDebugLogFile.txt", cAlternateFileName="FXSAPI~1.TXT")) returned 1 [0198.361] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1804b30, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf1804b30, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0x408bb4d0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x94, dwReserved0=0x0, dwReserved1=0x0, cFileName="gpustats.bx", cAlternateFileName="")) returned 1 [0198.362] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9a5f1ab0, ftCreationTime.dwHighDateTime=0x1d5dbe7, ftLastAccessTime.dwLowDateTime=0x4a85c690, ftLastAccessTime.dwHighDateTime=0x1d5e0f8, ftLastWriteTime.dwLowDateTime=0x4a85c690, ftLastWriteTime.dwHighDateTime=0x1d5e0f8, nFileSizeHigh=0x0, nFileSizeLow=0x273e, dwReserved0=0x0, dwReserved1=0x0, cFileName="hI7dcq.wav", cAlternateFileName="")) returned 1 [0198.362] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0198.362] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x17aa39b0, ftCreationTime.dwHighDateTime=0x1d5d7d7, ftLastAccessTime.dwLowDateTime=0xbc1dbdd0, ftLastAccessTime.dwHighDateTime=0x1d5dc39, ftLastWriteTime.dwLowDateTime=0xbc1dbdd0, ftLastWriteTime.dwHighDateTime=0x1d5dc39, nFileSizeHigh=0x0, nFileSizeLow=0xeaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="jjjiPdyoEp5H.jpg", cAlternateFileName="JJJIPD~1.JPG")) returned 1 [0198.362] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1158a930, ftCreationTime.dwHighDateTime=0x1d5e7f3, ftLastAccessTime.dwLowDateTime=0xebb4dc10, ftLastAccessTime.dwHighDateTime=0x1d5e4c0, ftLastWriteTime.dwLowDateTime=0xebb4dc10, ftLastWriteTime.dwHighDateTime=0x1d5e4c0, nFileSizeHigh=0x0, nFileSizeLow=0x1e98, dwReserved0=0x0, dwReserved1=0x0, cFileName="KnapLok_XqWA.mp3", cAlternateFileName="KNAPLO~1.MP3")) returned 1 [0198.362] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x950b5510, ftCreationTime.dwHighDateTime=0x1d5e295, ftLastAccessTime.dwLowDateTime=0xa3334ea0, ftLastAccessTime.dwHighDateTime=0x1d5d8d5, ftLastWriteTime.dwLowDateTime=0xa3334ea0, ftLastWriteTime.dwHighDateTime=0x1d5d8d5, nFileSizeHigh=0x0, nFileSizeLow=0xad0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="LcuZSRQ81m.bmp", cAlternateFileName="LCUZSR~1.BMP")) returned 1 [0198.363] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c67fd30, ftCreationTime.dwHighDateTime=0x1d5dd11, ftLastAccessTime.dwLowDateTime=0x903b17a0, ftLastAccessTime.dwHighDateTime=0x1d5d93a, ftLastWriteTime.dwLowDateTime=0x903b17a0, ftLastWriteTime.dwHighDateTime=0x1d5d93a, nFileSizeHigh=0x0, nFileSizeLow=0x1258, dwReserved0=0x0, dwReserved1=0x0, cFileName="LGBlh.png", cAlternateFileName="")) returned 1 [0198.363] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef4c66b0, ftCreationTime.dwHighDateTime=0x1d5da78, ftLastAccessTime.dwLowDateTime=0x85fc9b20, ftLastAccessTime.dwHighDateTime=0x1d5d7b3, ftLastWriteTime.dwLowDateTime=0x85fc9b20, ftLastWriteTime.dwHighDateTime=0x1d5d7b3, nFileSizeHigh=0x0, nFileSizeLow=0x9a51, dwReserved0=0x0, dwReserved1=0x0, cFileName="lPhqwdd.mkv", cAlternateFileName="")) returned 1 [0198.363] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x67ed1350, ftCreationTime.dwHighDateTime=0x1d5dcb1, ftLastAccessTime.dwLowDateTime=0x5b143350, ftLastAccessTime.dwHighDateTime=0x1d5e000, ftLastWriteTime.dwLowDateTime=0x5b143350, ftLastWriteTime.dwHighDateTime=0x1d5e000, nFileSizeHigh=0x0, nFileSizeLow=0x274d, dwReserved0=0x0, dwReserved1=0x0, cFileName="lUUqXpadmhf.gif", cAlternateFileName="LUUQXP~1.GIF")) returned 1 [0198.363] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda42f130, ftCreationTime.dwHighDateTime=0x1d5d893, ftLastAccessTime.dwLowDateTime=0x95a0280, ftLastAccessTime.dwHighDateTime=0x1d5e2a6, ftLastWriteTime.dwLowDateTime=0x95a0280, ftLastWriteTime.dwHighDateTime=0x1d5e2a6, nFileSizeHigh=0x0, nFileSizeLow=0x17a2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="mVNMnSYtuQS.avi", cAlternateFileName="MVNMNS~1.AVI")) returned 1 [0198.363] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1a20dc80, ftCreationTime.dwHighDateTime=0x1d5e2ef, ftLastAccessTime.dwLowDateTime=0x4320ae30, ftLastAccessTime.dwHighDateTime=0x1d5daa2, ftLastWriteTime.dwLowDateTime=0x4320ae30, ftLastWriteTime.dwHighDateTime=0x1d5daa2, nFileSizeHigh=0x0, nFileSizeLow=0x8b09, dwReserved0=0x0, dwReserved1=0x0, cFileName="n3GtYqkuzgbfFej.bmp", cAlternateFileName="N3GTYQ~1.BMP")) returned 1 [0198.364] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42d5aff0, ftCreationTime.dwHighDateTime=0x1d5e4bd, ftLastAccessTime.dwLowDateTime=0xa3223490, ftLastAccessTime.dwHighDateTime=0x1d5de9c, ftLastWriteTime.dwLowDateTime=0xa3223490, ftLastWriteTime.dwHighDateTime=0x1d5de9c, nFileSizeHigh=0x0, nFileSizeLow=0x17b1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NQd6iEWAJJNDx9.swf", cAlternateFileName="NQD6IE~1.SWF")) returned 1 [0198.364] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x118b2650, ftCreationTime.dwHighDateTime=0x1d5ddec, ftLastAccessTime.dwLowDateTime=0x8c619c60, ftLastAccessTime.dwHighDateTime=0x1d5df2c, ftLastWriteTime.dwLowDateTime=0x8c619c60, ftLastWriteTime.dwHighDateTime=0x1d5df2c, nFileSizeHigh=0x0, nFileSizeLow=0x6d4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="pf8VR.doc", cAlternateFileName="")) returned 1 [0198.364] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xca0072f0, ftCreationTime.dwHighDateTime=0x1d5e43e, ftLastAccessTime.dwLowDateTime=0x488f7650, ftLastAccessTime.dwHighDateTime=0x1d5e702, ftLastWriteTime.dwLowDateTime=0x488f7650, ftLastWriteTime.dwHighDateTime=0x1d5e702, nFileSizeHigh=0x0, nFileSizeLow=0x1d2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="puMUyOkInN5vYu.bmp", cAlternateFileName="PUMUYO~1.BMP")) returned 1 [0198.364] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf67c2c30, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf67c2c30, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf67c2c30, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ran.bx", cAlternateFileName="")) returned 1 [0198.364] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfb72aa0, ftCreationTime.dwHighDateTime=0x1d5e7a5, ftLastAccessTime.dwLowDateTime=0x7ff5690, ftLastAccessTime.dwHighDateTime=0x1d5d808, ftLastWriteTime.dwLowDateTime=0x7ff5690, ftLastWriteTime.dwHighDateTime=0x1d5d808, nFileSizeHigh=0x0, nFileSizeLow=0x6e48, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGjKRO.bmp", cAlternateFileName="")) returned 1 [0198.365] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa89f0ac0, ftCreationTime.dwHighDateTime=0x1d5e6fc, ftLastAccessTime.dwLowDateTime=0xe0bf87e0, ftLastAccessTime.dwHighDateTime=0x1d5e3d7, ftLastWriteTime.dwLowDateTime=0xe0bf87e0, ftLastWriteTime.dwHighDateTime=0x1d5e3d7, nFileSizeHigh=0x0, nFileSizeLow=0x28a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="rukJ2ki9DOoDHhK.mp3", cAlternateFileName="RUKJ2K~1.MP3")) returned 1 [0198.365] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0198.365] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x31f5580, ftCreationTime.dwHighDateTime=0x1d5e294, ftLastAccessTime.dwLowDateTime=0xd0dd62b0, ftLastAccessTime.dwHighDateTime=0x1d5dd66, ftLastWriteTime.dwLowDateTime=0xd0dd62b0, ftLastWriteTime.dwHighDateTime=0x1d5dd66, nFileSizeHigh=0x0, nFileSizeLow=0x14645, dwReserved0=0x0, dwReserved1=0x0, cFileName="TgReyANn2kjAJUG9.png", cAlternateFileName="TGREYA~1.PNG")) returned 1 [0198.365] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x65818490, ftCreationTime.dwHighDateTime=0x1d5e493, ftLastAccessTime.dwLowDateTime=0x6af43ce0, ftLastAccessTime.dwHighDateTime=0x1d5de32, ftLastWriteTime.dwLowDateTime=0x6af43ce0, ftLastWriteTime.dwHighDateTime=0x1d5de32, nFileSizeHigh=0x0, nFileSizeLow=0xc74a, dwReserved0=0x0, dwReserved1=0x0, cFileName="tkAF 9Ybmddq50wDQaF.wav", cAlternateFileName="TKAF9Y~1.WAV")) returned 1 [0198.365] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb9717ff0, ftCreationTime.dwHighDateTime=0x1d5dcf1, ftLastAccessTime.dwLowDateTime=0xda373160, ftLastAccessTime.dwHighDateTime=0x1d5dfe6, ftLastWriteTime.dwLowDateTime=0xda373160, ftLastWriteTime.dwHighDateTime=0x1d5dfe6, nFileSizeHigh=0x0, nFileSizeLow=0x7527, dwReserved0=0x0, dwReserved1=0x0, cFileName="tzH31l45.jpg", cAlternateFileName="")) returned 1 [0198.366] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x92470b00, ftCreationTime.dwHighDateTime=0x1d5da3c, ftLastAccessTime.dwLowDateTime=0x36dca210, ftLastAccessTime.dwHighDateTime=0x1d5e2fd, ftLastWriteTime.dwLowDateTime=0x36dca210, ftLastWriteTime.dwHighDateTime=0x1d5e2fd, nFileSizeHigh=0x0, nFileSizeLow=0xbb08, dwReserved0=0x0, dwReserved1=0x0, cFileName="US-VXYmW_QdpRyP4RM1Z.xls", cAlternateFileName="US-VXY~1.XLS")) returned 1 [0198.366] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x89aadc0, ftCreationTime.dwHighDateTime=0x1d5d86c, ftLastAccessTime.dwLowDateTime=0xa9de8de0, ftLastAccessTime.dwHighDateTime=0x1d5e402, ftLastWriteTime.dwLowDateTime=0xa9de8de0, ftLastWriteTime.dwHighDateTime=0x1d5e402, nFileSizeHigh=0x0, nFileSizeLow=0x3c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="vor0Oy7pcXjnQD6PP.swf", cAlternateFileName="VOR0OY~1.SWF")) returned 1 [0198.366] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x35fc1fa0, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x35fc1fa0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x35fc1fa0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPDNSE", cAlternateFileName="")) returned 1 [0198.366] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2baaf60, ftCreationTime.dwHighDateTime=0x1d5ddf6, ftLastAccessTime.dwLowDateTime=0x75b2e5d0, ftLastAccessTime.dwHighDateTime=0x1d5de0c, ftLastWriteTime.dwLowDateTime=0x75b2e5d0, ftLastWriteTime.dwHighDateTime=0x1d5de0c, nFileSizeHigh=0x0, nFileSizeLow=0x7305, dwReserved0=0x0, dwReserved1=0x0, cFileName="wZuI0X8AKAWESBdA.avi", cAlternateFileName="WZUI0X~1.AVI")) returned 1 [0198.366] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcbf8a4a0, ftCreationTime.dwHighDateTime=0x1d5dc97, ftLastAccessTime.dwLowDateTime=0x407045a0, ftLastAccessTime.dwHighDateTime=0x1d5e331, ftLastWriteTime.dwLowDateTime=0x407045a0, ftLastWriteTime.dwHighDateTime=0x1d5e331, nFileSizeHigh=0x0, nFileSizeLow=0x18006, dwReserved0=0x0, dwReserved1=0x0, cFileName="YsijQxuL.wav", cAlternateFileName="")) returned 1 [0198.366] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3c8b92d0, ftCreationTime.dwHighDateTime=0x1d5e51d, ftLastAccessTime.dwLowDateTime=0x3f3caac0, ftLastAccessTime.dwHighDateTime=0x1d5dca6, ftLastWriteTime.dwLowDateTime=0x3f3caac0, ftLastWriteTime.dwHighDateTime=0x1d5dca6, nFileSizeHigh=0x0, nFileSizeLow=0xfd1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="zQJQyNI.pps", cAlternateFileName="")) returned 1 [0198.367] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3c8b92d0, ftCreationTime.dwHighDateTime=0x1d5e51d, ftLastAccessTime.dwLowDateTime=0x3f3caac0, ftLastAccessTime.dwHighDateTime=0x1d5dca6, ftLastWriteTime.dwLowDateTime=0x3f3caac0, ftLastWriteTime.dwHighDateTime=0x1d5dca6, nFileSizeHigh=0x0, nFileSizeLow=0xfd1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="zQJQyNI.pps", cAlternateFileName="")) returned 0 [0198.367] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3d0) returned 1 [0198.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3dc) returned 1 [0198.367] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\.", nBufferLength=0x105, lpBuffer=0x58deed0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431", lpFilePart=0x0) returned 0x51 [0198.367] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431", nBufferLength=0x105, lpBuffer=0x58def04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431", lpFilePart=0x0) returned 0x51 [0198.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df360) returned 1 [0198.367] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431"), fInfoLevelId=0x0, lpFileInformation=0x58df3dc | out: lpFileInformation=0x58df3dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf3e40c90, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf3e40c90, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0198.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df35c) returned 1 [0198.368] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431", nBufferLength=0x105, lpBuffer=0x58def04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431", lpFilePart=0x0) returned 0x51 [0198.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3cc) returned 1 [0198.368] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431", nBufferLength=0x105, lpBuffer=0x58deed4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431", lpFilePart=0x0) returned 0x51 [0198.368] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\", nBufferLength=0x105, lpBuffer=0x58deea8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\", lpFilePart=0x0) returned 0x52 [0198.368] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\*", lpFindFileData=0x58df0f4 | out: lpFindFileData=0x58df0f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf3e40c90, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf3e40c90, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.368] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf3e40c90, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf3e40c90, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.369] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0x42ed14d0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x42ed14d0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ec3947efc19179a8010c6bae37caac89", cAlternateFileName="EC3947~1")) returned 1 [0198.369] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0198.369] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df38c) returned 1 [0198.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df398) returned 1 [0198.369] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\.", nBufferLength=0x105, lpBuffer=0x58dee8c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", lpFilePart=0x0) returned 0x72 [0198.369] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", nBufferLength=0x105, lpBuffer=0x58deec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", lpFilePart=0x0) returned 0x72 [0198.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df31c) returned 1 [0198.369] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89"), fInfoLevelId=0x0, lpFileInformation=0x58df398 | out: lpFileInformation=0x58df398*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0x42ed14d0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x42ed14d0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0198.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df318) returned 1 [0198.369] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", nBufferLength=0x105, lpBuffer=0x58deec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", lpFilePart=0x0) returned 0x72 [0198.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df388) returned 1 [0198.370] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", nBufferLength=0x105, lpBuffer=0x58dee90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", lpFilePart=0x0) returned 0x72 [0198.370] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\", nBufferLength=0x105, lpBuffer=0x58dee64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\", lpFilePart=0x0) returned 0x73 [0198.370] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\*", lpFindFileData=0x58df0b0 | out: lpFindFileData=0x58df0b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0x42ed14d0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x42ed14d0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.370] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0x42ed14d0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x42ed14d0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.370] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42c49d70, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43cf3770, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43cf3770, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dirs", cAlternateFileName="")) returned 1 [0198.370] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42ed14d0, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x42ed14d0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x42ed14d0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="processes.txt", cAlternateFileName="PROCES~1.TXT")) returned 1 [0198.370] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42ed14d0, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x42ed14d0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x42ed14d0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="processes.txt", cAlternateFileName="PROCES~1.TXT")) returned 0 [0198.371] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df348) returned 1 [0198.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df354) returned 1 [0198.371] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\.", nBufferLength=0x105, lpBuffer=0x58dee48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs", lpFilePart=0x0) returned 0x77 [0198.371] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs", nBufferLength=0x105, lpBuffer=0x58dee7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs", lpFilePart=0x0) returned 0x77 [0198.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df2d8) returned 1 [0198.371] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs"), fInfoLevelId=0x0, lpFileInformation=0x58df354 | out: lpFileInformation=0x58df354*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42c49d70, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43cf3770, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43cf3770, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0198.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df2d4) returned 1 [0198.371] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs", nBufferLength=0x105, lpBuffer=0x58dee7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs", lpFilePart=0x0) returned 0x77 [0198.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df344) returned 1 [0198.371] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs", nBufferLength=0x105, lpBuffer=0x58dee4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs", lpFilePart=0x0) returned 0x77 [0198.372] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\", nBufferLength=0x105, lpBuffer=0x58dee20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\", lpFilePart=0x0) returned 0x78 [0198.372] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\*", lpFindFileData=0x58df06c | out: lpFindFileData=0x58df06c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42c49d70, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43cf3770, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43cf3770, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.372] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42c49d70, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43cf3770, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43cf3770, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.372] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x433e0390, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x433e0390, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x434064f0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x3ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.txt", cAlternateFileName="")) returned 1 [0198.372] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43ade430, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43ade430, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43ade430, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x559, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents.txt", cAlternateFileName="DOCUME~1.TXT")) returned 1 [0198.373] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43cf3770, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43cf3770, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43cf3770, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads.txt", cAlternateFileName="DOWNLO~1.TXT")) returned 1 [0198.374] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43b2a6f0, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43b2a6f0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43b2a6f0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x31f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures.txt", cAlternateFileName="")) returned 1 [0198.374] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43cf3770, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43cf3770, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43cf3770, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Startup.txt", cAlternateFileName="")) returned 1 [0198.374] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43ccd610, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43ccd610, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43ccd610, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos.txt", cAlternateFileName="")) returned 1 [0198.374] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43ccd610, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43ccd610, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43ccd610, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos.txt", cAlternateFileName="")) returned 0 [0198.374] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df304) returned 1 [0198.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df310) returned 1 [0198.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df344) returned 1 [0198.375] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs", nBufferLength=0x105, lpBuffer=0x58dee4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs", lpFilePart=0x0) returned 0x77 [0198.375] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\", nBufferLength=0x105, lpBuffer=0x58dee20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\", lpFilePart=0x0) returned 0x78 [0198.375] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\*", lpFindFileData=0x58df06c | out: lpFindFileData=0x58df06c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42c49d70, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43cf3770, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43cf3770, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.375] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42c49d70, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43cf3770, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43cf3770, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.375] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x433e0390, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x433e0390, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x434064f0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x3ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.txt", cAlternateFileName="")) returned 1 [0198.375] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43ade430, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43ade430, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43ade430, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x559, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents.txt", cAlternateFileName="DOCUME~1.TXT")) returned 1 [0198.376] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43cf3770, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43cf3770, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43cf3770, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads.txt", cAlternateFileName="DOWNLO~1.TXT")) returned 1 [0198.376] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43b2a6f0, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43b2a6f0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43b2a6f0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x31f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures.txt", cAlternateFileName="")) returned 1 [0198.376] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43cf3770, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43cf3770, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43cf3770, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Startup.txt", cAlternateFileName="")) returned 1 [0198.376] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43ccd610, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43ccd610, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43ccd610, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos.txt", cAlternateFileName="")) returned 1 [0198.376] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0198.376] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df304) returned 1 [0198.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df310) returned 1 [0198.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df388) returned 1 [0198.377] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", nBufferLength=0x105, lpBuffer=0x58dee90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", lpFilePart=0x0) returned 0x72 [0198.377] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\", nBufferLength=0x105, lpBuffer=0x58dee64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\", lpFilePart=0x0) returned 0x73 [0198.377] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\*", lpFindFileData=0x58df0b0 | out: lpFindFileData=0x58df0b0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0x42ed14d0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x42ed14d0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.377] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0x42ed14d0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x42ed14d0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.377] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42c49d70, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43cf3770, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43cf3770, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dirs", cAlternateFileName="")) returned 1 [0198.378] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42ed14d0, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x42ed14d0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x42ed14d0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="processes.txt", cAlternateFileName="PROCES~1.TXT")) returned 1 [0198.378] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0198.378] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df348) returned 1 [0198.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df354) returned 1 [0198.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3cc) returned 1 [0198.378] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431", nBufferLength=0x105, lpBuffer=0x58deed4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431", lpFilePart=0x0) returned 0x51 [0198.378] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\", nBufferLength=0x105, lpBuffer=0x58deea8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\", lpFilePart=0x0) returned 0x52 [0198.379] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\*", lpFindFileData=0x58df0f4 | out: lpFindFileData=0x58df0f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf3e40c90, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf3e40c90, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.379] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf3e40c90, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf3e40c90, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.379] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0x42ed14d0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x42ed14d0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ec3947efc19179a8010c6bae37caac89", cAlternateFileName="EC3947~1")) returned 1 [0198.379] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0x42ed14d0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x42ed14d0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ec3947efc19179a8010c6bae37caac89", cAlternateFileName="EC3947~1")) returned 0 [0198.379] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df38c) returned 1 [0198.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df398) returned 1 [0198.380] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\.", nBufferLength=0x105, lpBuffer=0x58deed0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies", lpFilePart=0x0) returned 0x38 [0198.380] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies", nBufferLength=0x105, lpBuffer=0x58def04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies", lpFilePart=0x0) returned 0x38 [0198.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df360) returned 1 [0198.380] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cookies"), fInfoLevelId=0x0, lpFileInformation=0x58df3dc | out: lpFileInformation=0x58df3dc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0198.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df35c) returned 1 [0198.384] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies", nBufferLength=0x105, lpBuffer=0x58def04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies", lpFilePart=0x0) returned 0x38 [0198.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3cc) returned 1 [0198.384] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies", nBufferLength=0x105, lpBuffer=0x58deed4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies", lpFilePart=0x0) returned 0x38 [0198.384] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\", nBufferLength=0x105, lpBuffer=0x58deea8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\", lpFilePart=0x0) returned 0x39 [0198.385] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\*", lpFindFileData=0x58df0f4 | out: lpFindFileData=0x58df0f4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.385] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.385] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0198.385] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0198.385] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df38c) returned 1 [0198.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df398) returned 1 [0198.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3cc) returned 1 [0198.386] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies", nBufferLength=0x105, lpBuffer=0x58deed4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies", lpFilePart=0x0) returned 0x38 [0198.386] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\", nBufferLength=0x105, lpBuffer=0x58deea8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\", lpFilePart=0x0) returned 0x39 [0198.386] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\*", lpFindFileData=0x58df0f4 | out: lpFindFileData=0x58df0f4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.386] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.386] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0198.386] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0198.386] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df38c) returned 1 [0198.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df398) returned 1 [0198.387] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\.", nBufferLength=0x105, lpBuffer=0x58deed0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History", lpFilePart=0x0) returned 0x38 [0198.387] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History", nBufferLength=0x105, lpBuffer=0x58def04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History", lpFilePart=0x0) returned 0x38 [0198.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df360) returned 1 [0198.387] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history"), fInfoLevelId=0x0, lpFileInformation=0x58df3dc | out: lpFileInformation=0x58df3dc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0198.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df35c) returned 1 [0198.391] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History", nBufferLength=0x105, lpBuffer=0x58def04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History", lpFilePart=0x0) returned 0x38 [0198.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3cc) returned 1 [0198.391] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History", nBufferLength=0x105, lpBuffer=0x58deed4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History", lpFilePart=0x0) returned 0x38 [0198.391] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\", nBufferLength=0x105, lpBuffer=0x58deea8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\", lpFilePart=0x0) returned 0x39 [0198.391] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\*", lpFindFileData=0x58df0f4 | out: lpFindFileData=0x58df0f4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.391] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.391] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1 [0198.392] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0198.392] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df38c) returned 1 [0198.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df398) returned 1 [0198.392] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\.", nBufferLength=0x105, lpBuffer=0x58dee8c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5", lpFilePart=0x0) returned 0x44 [0198.392] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5", nBufferLength=0x105, lpBuffer=0x58deec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5", lpFilePart=0x0) returned 0x44 [0198.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df31c) returned 1 [0198.392] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5"), fInfoLevelId=0x0, lpFileInformation=0x58df398 | out: lpFileInformation=0x58df398*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0198.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df318) returned 1 [0198.392] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5", nBufferLength=0x105, lpBuffer=0x58deec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5", lpFilePart=0x0) returned 0x44 [0198.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df388) returned 1 [0198.392] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5", nBufferLength=0x105, lpBuffer=0x58dee90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5", lpFilePart=0x0) returned 0x44 [0198.392] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\", nBufferLength=0x105, lpBuffer=0x58dee64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\", lpFilePart=0x0) returned 0x45 [0198.393] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\*", lpFindFileData=0x58df0b0 | out: lpFindFileData=0x58df0b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.393] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.393] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9824200, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0198.393] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0198.393] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0198.394] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df348) returned 1 [0198.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df354) returned 1 [0198.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df388) returned 1 [0198.394] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5", nBufferLength=0x105, lpBuffer=0x58dee90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5", lpFilePart=0x0) returned 0x44 [0198.394] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\", nBufferLength=0x105, lpBuffer=0x58dee64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\", lpFilePart=0x0) returned 0x45 [0198.394] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\*", lpFindFileData=0x58df0b0 | out: lpFindFileData=0x58df0b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.394] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.395] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9824200, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0198.395] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0198.395] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0198.395] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df348) returned 1 [0198.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df354) returned 1 [0198.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3cc) returned 1 [0198.395] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History", nBufferLength=0x105, lpBuffer=0x58deed4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History", lpFilePart=0x0) returned 0x38 [0198.395] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\", nBufferLength=0x105, lpBuffer=0x58deea8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\", lpFilePart=0x0) returned 0x39 [0198.395] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\*", lpFindFileData=0x58df0f4 | out: lpFindFileData=0x58df0f4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.396] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.396] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1 [0198.396] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 0 [0198.396] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df38c) returned 1 [0198.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df398) returned 1 [0198.396] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\.", nBufferLength=0x105, lpBuffer=0x58deed0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files", lpFilePart=0x0) returned 0x49 [0198.396] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files", nBufferLength=0x105, lpBuffer=0x58def04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files", lpFilePart=0x0) returned 0x49 [0198.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df360) returned 1 [0198.397] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files"), fInfoLevelId=0x0, lpFileInformation=0x58df3dc | out: lpFileInformation=0x58df3dc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0198.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df35c) returned 1 [0198.405] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files", nBufferLength=0x105, lpBuffer=0x58def04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files", lpFilePart=0x0) returned 0x49 [0198.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3cc) returned 1 [0198.405] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files", nBufferLength=0x105, lpBuffer=0x58deed4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files", lpFilePart=0x0) returned 0x49 [0198.405] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\", nBufferLength=0x105, lpBuffer=0x58deea8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\", lpFilePart=0x0) returned 0x4a [0198.406] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\*", lpFindFileData=0x58df0f4 | out: lpFindFileData=0x58df0f4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.406] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.406] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 1 [0198.406] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0198.406] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df38c) returned 1 [0198.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df398) returned 1 [0198.406] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\.", nBufferLength=0x105, lpBuffer=0x58dee8c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5", lpFilePart=0x0) returned 0x55 [0198.407] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5", nBufferLength=0x105, lpBuffer=0x58deec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5", lpFilePart=0x0) returned 0x55 [0198.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df31c) returned 1 [0198.407] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5"), fInfoLevelId=0x0, lpFileInformation=0x58df398 | out: lpFileInformation=0x58df398*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0198.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df318) returned 1 [0198.407] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5", nBufferLength=0x105, lpBuffer=0x58deec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5", lpFilePart=0x0) returned 0x55 [0198.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df388) returned 1 [0198.407] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5", nBufferLength=0x105, lpBuffer=0x58dee90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5", lpFilePart=0x0) returned 0x55 [0198.407] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\", nBufferLength=0x105, lpBuffer=0x58dee64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\", lpFilePart=0x0) returned 0x56 [0198.407] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\*", lpFindFileData=0x58df0b0 | out: lpFindFileData=0x58df0b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.408] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.408] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="03J4UQW0", cAlternateFileName="")) returned 1 [0198.408] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0198.408] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0198.408] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KETAJP6D", cAlternateFileName="")) returned 1 [0198.408] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VB18B0KB", cAlternateFileName="")) returned 1 [0198.409] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XT1RPYG9", cAlternateFileName="")) returned 1 [0198.409] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0198.409] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.409] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df348) returned 1 [0198.409] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df354) returned 1 [0198.409] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\.", nBufferLength=0x105, lpBuffer=0x58dee48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0", lpFilePart=0x0) returned 0x5e [0198.409] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0", nBufferLength=0x105, lpBuffer=0x58dee7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0", lpFilePart=0x0) returned 0x5e [0198.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df2d8) returned 1 [0198.409] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\03j4uqw0"), fInfoLevelId=0x0, lpFileInformation=0x58df354 | out: lpFileInformation=0x58df354*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0198.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df2d4) returned 1 [0198.417] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0", nBufferLength=0x105, lpBuffer=0x58dee7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0", lpFilePart=0x0) returned 0x5e [0198.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df344) returned 1 [0198.417] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0", nBufferLength=0x105, lpBuffer=0x58dee4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0", lpFilePart=0x0) returned 0x5e [0198.417] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\", nBufferLength=0x105, lpBuffer=0x58dee20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\", lpFilePart=0x0) returned 0x5f [0198.417] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\*", lpFindFileData=0x58df06c | out: lpFindFileData=0x58df06c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.417] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.418] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0198.418] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0198.418] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df304) returned 1 [0198.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df310) returned 1 [0198.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df344) returned 1 [0198.418] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0", nBufferLength=0x105, lpBuffer=0x58dee4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0", lpFilePart=0x0) returned 0x5e [0198.418] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\", nBufferLength=0x105, lpBuffer=0x58dee20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\", lpFilePart=0x0) returned 0x5f [0198.418] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\*", lpFindFileData=0x58df06c | out: lpFindFileData=0x58df06c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.419] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.419] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0198.419] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0198.419] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df304) returned 1 [0198.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df310) returned 1 [0198.419] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\.", nBufferLength=0x105, lpBuffer=0x58dee48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D", lpFilePart=0x0) returned 0x5e [0198.419] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D", nBufferLength=0x105, lpBuffer=0x58dee7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D", lpFilePart=0x0) returned 0x5e [0198.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df2d8) returned 1 [0198.420] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\ketajp6d"), fInfoLevelId=0x0, lpFileInformation=0x58df354 | out: lpFileInformation=0x58df354*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0198.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df2d4) returned 1 [0198.420] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D", nBufferLength=0x105, lpBuffer=0x58dee7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D", lpFilePart=0x0) returned 0x5e [0198.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df344) returned 1 [0198.420] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D", nBufferLength=0x105, lpBuffer=0x58dee4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D", lpFilePart=0x0) returned 0x5e [0198.420] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\", nBufferLength=0x105, lpBuffer=0x58dee20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\", lpFilePart=0x0) returned 0x5f [0198.420] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\*", lpFindFileData=0x58df06c | out: lpFindFileData=0x58df06c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.420] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.421] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0198.421] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0198.421] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df304) returned 1 [0198.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df310) returned 1 [0198.421] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df344) returned 1 [0198.421] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D", nBufferLength=0x105, lpBuffer=0x58dee4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D", lpFilePart=0x0) returned 0x5e [0198.422] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\", nBufferLength=0x105, lpBuffer=0x58dee20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\", lpFilePart=0x0) returned 0x5f [0198.422] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\*", lpFindFileData=0x58df06c | out: lpFindFileData=0x58df06c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.422] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.422] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0198.422] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0198.422] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df304) returned 1 [0198.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df310) returned 1 [0198.423] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\.", nBufferLength=0x105, lpBuffer=0x58dee48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB", lpFilePart=0x0) returned 0x5e [0198.423] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB", nBufferLength=0x105, lpBuffer=0x58dee7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB", lpFilePart=0x0) returned 0x5e [0198.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df2d8) returned 1 [0198.423] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\vb18b0kb"), fInfoLevelId=0x0, lpFileInformation=0x58df354 | out: lpFileInformation=0x58df354*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0198.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df2d4) returned 1 [0198.423] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB", nBufferLength=0x105, lpBuffer=0x58dee7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB", lpFilePart=0x0) returned 0x5e [0198.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df344) returned 1 [0198.423] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB", nBufferLength=0x105, lpBuffer=0x58dee4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB", lpFilePart=0x0) returned 0x5e [0198.423] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\", nBufferLength=0x105, lpBuffer=0x58dee20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\", lpFilePart=0x0) returned 0x5f [0198.423] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\*", lpFindFileData=0x58df06c | out: lpFindFileData=0x58df06c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.424] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.424] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0198.424] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0198.424] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df304) returned 1 [0198.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df310) returned 1 [0198.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df344) returned 1 [0198.425] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB", nBufferLength=0x105, lpBuffer=0x58dee4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB", lpFilePart=0x0) returned 0x5e [0198.425] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\", nBufferLength=0x105, lpBuffer=0x58dee20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\", lpFilePart=0x0) returned 0x5f [0198.425] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\*", lpFindFileData=0x58df06c | out: lpFindFileData=0x58df06c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.425] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.425] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0198.425] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0198.425] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df304) returned 1 [0198.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df310) returned 1 [0198.426] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\.", nBufferLength=0x105, lpBuffer=0x58dee48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9", lpFilePart=0x0) returned 0x5e [0198.426] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9", nBufferLength=0x105, lpBuffer=0x58dee7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9", lpFilePart=0x0) returned 0x5e [0198.426] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df2d8) returned 1 [0198.426] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\xt1rpyg9"), fInfoLevelId=0x0, lpFileInformation=0x58df354 | out: lpFileInformation=0x58df354*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0198.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df2d4) returned 1 [0198.439] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9", nBufferLength=0x105, lpBuffer=0x58dee7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9", lpFilePart=0x0) returned 0x5e [0198.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df344) returned 1 [0198.439] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9", nBufferLength=0x105, lpBuffer=0x58dee4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9", lpFilePart=0x0) returned 0x5e [0198.439] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\", nBufferLength=0x105, lpBuffer=0x58dee20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\", lpFilePart=0x0) returned 0x5f [0198.439] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\*", lpFindFileData=0x58df06c | out: lpFindFileData=0x58df06c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.439] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.439] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0198.440] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0198.440] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.440] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df304) returned 1 [0198.440] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df310) returned 1 [0198.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df344) returned 1 [0198.440] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9", nBufferLength=0x105, lpBuffer=0x58dee4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9", lpFilePart=0x0) returned 0x5e [0198.440] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\", nBufferLength=0x105, lpBuffer=0x58dee20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\", lpFilePart=0x0) returned 0x5f [0198.440] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\*", lpFindFileData=0x58df06c | out: lpFindFileData=0x58df06c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.440] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.441] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0198.441] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df07c | out: lpFindFileData=0x58df07c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0198.441] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df304) returned 1 [0198.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df310) returned 1 [0198.441] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df388) returned 1 [0198.441] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5", nBufferLength=0x105, lpBuffer=0x58dee90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5", lpFilePart=0x0) returned 0x55 [0198.441] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\", nBufferLength=0x105, lpBuffer=0x58dee64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\", lpFilePart=0x0) returned 0x56 [0198.441] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\*", lpFindFileData=0x58df0b0 | out: lpFindFileData=0x58df0b0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.442] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.442] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="03J4UQW0", cAlternateFileName="")) returned 1 [0198.442] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0198.442] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0198.442] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KETAJP6D", cAlternateFileName="")) returned 1 [0198.442] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VB18B0KB", cAlternateFileName="")) returned 1 [0198.443] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XT1RPYG9", cAlternateFileName="")) returned 1 [0198.443] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df0c0 | out: lpFindFileData=0x58df0c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XT1RPYG9", cAlternateFileName="")) returned 0 [0198.443] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df348) returned 1 [0198.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df354) returned 1 [0198.443] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3cc) returned 1 [0198.443] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files", nBufferLength=0x105, lpBuffer=0x58deed4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files", lpFilePart=0x0) returned 0x49 [0198.443] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\", nBufferLength=0x105, lpBuffer=0x58deea8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\", lpFilePart=0x0) returned 0x4a [0198.443] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\*", lpFindFileData=0x58df0f4 | out: lpFindFileData=0x58df0f4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.444] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.444] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 1 [0198.444] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 0 [0198.444] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df38c) returned 1 [0198.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df398) returned 1 [0198.444] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE\\.", nBufferLength=0x105, lpBuffer=0x58deed0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE", lpFilePart=0x0) returned 0x37 [0198.445] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE", nBufferLength=0x105, lpBuffer=0x58def04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE", lpFilePart=0x0) returned 0x37 [0198.445] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df360) returned 1 [0198.445] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\wpdnse"), fInfoLevelId=0x0, lpFileInformation=0x58df3dc | out: lpFileInformation=0x58df3dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x35fc1fa0, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x35fc1fa0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x35fc1fa0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0198.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df35c) returned 1 [0198.446] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE", nBufferLength=0x105, lpBuffer=0x58def04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE", lpFilePart=0x0) returned 0x37 [0198.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3cc) returned 1 [0198.446] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE", nBufferLength=0x105, lpBuffer=0x58deed4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE", lpFilePart=0x0) returned 0x37 [0198.446] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE\\", nBufferLength=0x105, lpBuffer=0x58deea8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE\\", lpFilePart=0x0) returned 0x38 [0198.446] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE\\*", lpFindFileData=0x58df0f4 | out: lpFindFileData=0x58df0f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x35fc1fa0, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x35fc1fa0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x35fc1fa0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.447] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x35fc1fa0, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x35fc1fa0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x35fc1fa0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.447] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x35fc1fa0, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x35fc1fa0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x35fc1fa0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0198.447] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df38c) returned 1 [0198.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df398) returned 1 [0198.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3cc) returned 1 [0198.447] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE", nBufferLength=0x105, lpBuffer=0x58deed4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE", lpFilePart=0x0) returned 0x37 [0198.447] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE\\", nBufferLength=0x105, lpBuffer=0x58deea8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE\\", lpFilePart=0x0) returned 0x38 [0198.447] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE\\*", lpFindFileData=0x58df0f4 | out: lpFindFileData=0x58df0f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x35fc1fa0, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x35fc1fa0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x35fc1fa0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.448] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x35fc1fa0, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x35fc1fa0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x35fc1fa0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.448] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df104 | out: lpFindFileData=0x58df104*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x35fc1fa0, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x35fc1fa0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x35fc1fa0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0198.448] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df38c) returned 1 [0198.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df398) returned 1 [0198.448] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df410) returned 1 [0198.448] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x58def18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x30 [0198.448] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x58deeec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x31 [0198.448] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\*", lpFindFileData=0x58df138 | out: lpFindFileData=0x58df138*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x35fc1fa0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x35fc1fa0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9b2960 [0198.449] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x35fc1fa0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x35fc1fa0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.449] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x513882c0, ftCreationTime.dwHighDateTime=0x1d5e639, ftLastAccessTime.dwLowDateTime=0xa93da3d0, ftLastAccessTime.dwHighDateTime=0x1d5e25e, ftLastWriteTime.dwLowDateTime=0xa93da3d0, ftLastWriteTime.dwHighDateTime=0x1d5e25e, nFileSizeHigh=0x0, nFileSizeLow=0x33f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="2Z8kQwlSPW.avi", cAlternateFileName="2Z8KQW~1.AVI")) returned 1 [0198.449] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8aa26310, ftCreationTime.dwHighDateTime=0x1d5e304, ftLastAccessTime.dwLowDateTime=0x68df32d0, ftLastAccessTime.dwHighDateTime=0x1d5e575, ftLastWriteTime.dwLowDateTime=0x68df32d0, ftLastWriteTime.dwHighDateTime=0x1d5e575, nFileSizeHigh=0x0, nFileSizeLow=0x1778a, dwReserved0=0x0, dwReserved1=0x0, cFileName="4 gCmsKJ4.odp", cAlternateFileName="4GCMSK~1.ODP")) returned 1 [0198.449] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x88265730, ftCreationTime.dwHighDateTime=0x1d5dc0c, ftLastAccessTime.dwLowDateTime=0xf362d1d0, ftLastAccessTime.dwHighDateTime=0x1d5d992, ftLastWriteTime.dwLowDateTime=0xf362d1d0, ftLastWriteTime.dwHighDateTime=0x1d5d992, nFileSizeHigh=0x0, nFileSizeLow=0x3902, dwReserved0=0x0, dwReserved1=0x0, cFileName="5-au8sTR_DKW.bmp", cAlternateFileName="5-AU8S~1.BMP")) returned 1 [0198.449] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84e753a0, ftCreationTime.dwHighDateTime=0x1d5e5e2, ftLastAccessTime.dwLowDateTime=0x45006620, ftLastAccessTime.dwHighDateTime=0x1d5da5f, ftLastWriteTime.dwLowDateTime=0x45006620, ftLastWriteTime.dwHighDateTime=0x1d5da5f, nFileSizeHigh=0x0, nFileSizeLow=0x350e, dwReserved0=0x0, dwReserved1=0x0, cFileName="57qTz_2cSF05D7BsCcc.pps", cAlternateFileName="57QTZ_~1.PPS")) returned 1 [0198.449] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe0cff6c0, ftCreationTime.dwHighDateTime=0x1d5e062, ftLastAccessTime.dwLowDateTime=0xb986d250, ftLastAccessTime.dwHighDateTime=0x1d5e6d9, ftLastWriteTime.dwLowDateTime=0xb986d250, ftLastWriteTime.dwHighDateTime=0x1d5e6d9, nFileSizeHigh=0x0, nFileSizeLow=0x5964, dwReserved0=0x0, dwReserved1=0x0, cFileName="6o74G.mp3", cAlternateFileName="")) returned 1 [0198.449] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe58ff980, ftCreationTime.dwHighDateTime=0x1d5dee6, ftLastAccessTime.dwLowDateTime=0x73d64b0, ftLastAccessTime.dwHighDateTime=0x1d5dfe0, ftLastWriteTime.dwLowDateTime=0x73d64b0, ftLastWriteTime.dwHighDateTime=0x1d5dfe0, nFileSizeHigh=0x0, nFileSizeLow=0x100fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="7OhdXa3ktL4-VE8Up.mkv", cAlternateFileName="7OHDXA~1.MKV")) returned 1 [0198.450] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf3e40c90, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf3e40c90, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9df274b54410817b3690312b4cb55431", cAlternateFileName="9DF274~1")) returned 1 [0198.450] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a0318e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x6a0318e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x32d9b1c0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x900, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeARM.log", cAlternateFileName="")) returned 1 [0198.450] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6be9bb00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x6be9bb00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x6be9bb00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bst449D.tmp", cAlternateFileName="")) returned 1 [0198.450] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5ca50, ftCreationTime.dwHighDateTime=0x1d5d89c, ftLastAccessTime.dwLowDateTime=0x6b882ea0, ftLastAccessTime.dwHighDateTime=0x1d5e729, ftLastWriteTime.dwLowDateTime=0x6b882ea0, ftLastWriteTime.dwHighDateTime=0x1d5e729, nFileSizeHigh=0x0, nFileSizeLow=0x3641, dwReserved0=0x0, dwReserved1=0x0, cFileName="BXPtYk9CKQNZ.bmp", cAlternateFileName="BXPTYK~1.BMP")) returned 1 [0198.450] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0198.450] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7adf8600, ftCreationTime.dwHighDateTime=0x1d5e012, ftLastAccessTime.dwLowDateTime=0xda8116a0, ftLastAccessTime.dwHighDateTime=0x1d5e44f, ftLastWriteTime.dwLowDateTime=0xda8116a0, ftLastWriteTime.dwHighDateTime=0x1d5e44f, nFileSizeHigh=0x0, nFileSizeLow=0x17a7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="d_9fzjXN59RtsG6FF.wav", cAlternateFileName="D_9FZJ~1.WAV")) returned 1 [0198.450] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa53eae00, ftCreationTime.dwHighDateTime=0x1d5e786, ftLastAccessTime.dwLowDateTime=0xb4ad3980, ftLastAccessTime.dwHighDateTime=0x1d5e4e6, ftLastWriteTime.dwLowDateTime=0xb4ad3980, ftLastWriteTime.dwHighDateTime=0x1d5e4e6, nFileSizeHigh=0x0, nFileSizeLow=0x309d, dwReserved0=0x0, dwReserved1=0x0, cFileName="EJsyP17Z.csv", cAlternateFileName="")) returned 1 [0198.451] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb84a230, ftCreationTime.dwHighDateTime=0x1d5de96, ftLastAccessTime.dwLowDateTime=0x91f8d5a0, ftLastAccessTime.dwHighDateTime=0x1d5e49d, ftLastWriteTime.dwLowDateTime=0x91f8d5a0, ftLastWriteTime.dwHighDateTime=0x1d5e49d, nFileSizeHigh=0x0, nFileSizeLow=0x51a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="F1_TNQKi1ckgpfT.docx", cAlternateFileName="F1_TNQ~1.DOC")) returned 1 [0198.451] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33d9ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x33d9ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FXSAPIDebugLogFile.txt", cAlternateFileName="FXSAPI~1.TXT")) returned 1 [0198.451] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1804b30, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf1804b30, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0x408bb4d0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x94, dwReserved0=0x0, dwReserved1=0x0, cFileName="gpustats.bx", cAlternateFileName="")) returned 1 [0198.451] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9a5f1ab0, ftCreationTime.dwHighDateTime=0x1d5dbe7, ftLastAccessTime.dwLowDateTime=0x4a85c690, ftLastAccessTime.dwHighDateTime=0x1d5e0f8, ftLastWriteTime.dwLowDateTime=0x4a85c690, ftLastWriteTime.dwHighDateTime=0x1d5e0f8, nFileSizeHigh=0x0, nFileSizeLow=0x273e, dwReserved0=0x0, dwReserved1=0x0, cFileName="hI7dcq.wav", cAlternateFileName="")) returned 1 [0198.451] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0198.451] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x17aa39b0, ftCreationTime.dwHighDateTime=0x1d5d7d7, ftLastAccessTime.dwLowDateTime=0xbc1dbdd0, ftLastAccessTime.dwHighDateTime=0x1d5dc39, ftLastWriteTime.dwLowDateTime=0xbc1dbdd0, ftLastWriteTime.dwHighDateTime=0x1d5dc39, nFileSizeHigh=0x0, nFileSizeLow=0xeaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="jjjiPdyoEp5H.jpg", cAlternateFileName="JJJIPD~1.JPG")) returned 1 [0198.451] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1158a930, ftCreationTime.dwHighDateTime=0x1d5e7f3, ftLastAccessTime.dwLowDateTime=0xebb4dc10, ftLastAccessTime.dwHighDateTime=0x1d5e4c0, ftLastWriteTime.dwLowDateTime=0xebb4dc10, ftLastWriteTime.dwHighDateTime=0x1d5e4c0, nFileSizeHigh=0x0, nFileSizeLow=0x1e98, dwReserved0=0x0, dwReserved1=0x0, cFileName="KnapLok_XqWA.mp3", cAlternateFileName="KNAPLO~1.MP3")) returned 1 [0198.452] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x950b5510, ftCreationTime.dwHighDateTime=0x1d5e295, ftLastAccessTime.dwLowDateTime=0xa3334ea0, ftLastAccessTime.dwHighDateTime=0x1d5d8d5, ftLastWriteTime.dwLowDateTime=0xa3334ea0, ftLastWriteTime.dwHighDateTime=0x1d5d8d5, nFileSizeHigh=0x0, nFileSizeLow=0xad0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="LcuZSRQ81m.bmp", cAlternateFileName="LCUZSR~1.BMP")) returned 1 [0198.452] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c67fd30, ftCreationTime.dwHighDateTime=0x1d5dd11, ftLastAccessTime.dwLowDateTime=0x903b17a0, ftLastAccessTime.dwHighDateTime=0x1d5d93a, ftLastWriteTime.dwLowDateTime=0x903b17a0, ftLastWriteTime.dwHighDateTime=0x1d5d93a, nFileSizeHigh=0x0, nFileSizeLow=0x1258, dwReserved0=0x0, dwReserved1=0x0, cFileName="LGBlh.png", cAlternateFileName="")) returned 1 [0198.452] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef4c66b0, ftCreationTime.dwHighDateTime=0x1d5da78, ftLastAccessTime.dwLowDateTime=0x85fc9b20, ftLastAccessTime.dwHighDateTime=0x1d5d7b3, ftLastWriteTime.dwLowDateTime=0x85fc9b20, ftLastWriteTime.dwHighDateTime=0x1d5d7b3, nFileSizeHigh=0x0, nFileSizeLow=0x9a51, dwReserved0=0x0, dwReserved1=0x0, cFileName="lPhqwdd.mkv", cAlternateFileName="")) returned 1 [0198.452] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x67ed1350, ftCreationTime.dwHighDateTime=0x1d5dcb1, ftLastAccessTime.dwLowDateTime=0x5b143350, ftLastAccessTime.dwHighDateTime=0x1d5e000, ftLastWriteTime.dwLowDateTime=0x5b143350, ftLastWriteTime.dwHighDateTime=0x1d5e000, nFileSizeHigh=0x0, nFileSizeLow=0x274d, dwReserved0=0x0, dwReserved1=0x0, cFileName="lUUqXpadmhf.gif", cAlternateFileName="LUUQXP~1.GIF")) returned 1 [0198.452] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda42f130, ftCreationTime.dwHighDateTime=0x1d5d893, ftLastAccessTime.dwLowDateTime=0x95a0280, ftLastAccessTime.dwHighDateTime=0x1d5e2a6, ftLastWriteTime.dwLowDateTime=0x95a0280, ftLastWriteTime.dwHighDateTime=0x1d5e2a6, nFileSizeHigh=0x0, nFileSizeLow=0x17a2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="mVNMnSYtuQS.avi", cAlternateFileName="MVNMNS~1.AVI")) returned 1 [0198.452] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1a20dc80, ftCreationTime.dwHighDateTime=0x1d5e2ef, ftLastAccessTime.dwLowDateTime=0x4320ae30, ftLastAccessTime.dwHighDateTime=0x1d5daa2, ftLastWriteTime.dwLowDateTime=0x4320ae30, ftLastWriteTime.dwHighDateTime=0x1d5daa2, nFileSizeHigh=0x0, nFileSizeLow=0x8b09, dwReserved0=0x0, dwReserved1=0x0, cFileName="n3GtYqkuzgbfFej.bmp", cAlternateFileName="N3GTYQ~1.BMP")) returned 1 [0198.452] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42d5aff0, ftCreationTime.dwHighDateTime=0x1d5e4bd, ftLastAccessTime.dwLowDateTime=0xa3223490, ftLastAccessTime.dwHighDateTime=0x1d5de9c, ftLastWriteTime.dwLowDateTime=0xa3223490, ftLastWriteTime.dwHighDateTime=0x1d5de9c, nFileSizeHigh=0x0, nFileSizeLow=0x17b1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NQd6iEWAJJNDx9.swf", cAlternateFileName="NQD6IE~1.SWF")) returned 1 [0198.453] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x118b2650, ftCreationTime.dwHighDateTime=0x1d5ddec, ftLastAccessTime.dwLowDateTime=0x8c619c60, ftLastAccessTime.dwHighDateTime=0x1d5df2c, ftLastWriteTime.dwLowDateTime=0x8c619c60, ftLastWriteTime.dwHighDateTime=0x1d5df2c, nFileSizeHigh=0x0, nFileSizeLow=0x6d4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="pf8VR.doc", cAlternateFileName="")) returned 1 [0198.453] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xca0072f0, ftCreationTime.dwHighDateTime=0x1d5e43e, ftLastAccessTime.dwLowDateTime=0x488f7650, ftLastAccessTime.dwHighDateTime=0x1d5e702, ftLastWriteTime.dwLowDateTime=0x488f7650, ftLastWriteTime.dwHighDateTime=0x1d5e702, nFileSizeHigh=0x0, nFileSizeLow=0x1d2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="puMUyOkInN5vYu.bmp", cAlternateFileName="PUMUYO~1.BMP")) returned 1 [0198.453] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf67c2c30, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf67c2c30, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf67c2c30, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ran.bx", cAlternateFileName="")) returned 1 [0198.453] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfb72aa0, ftCreationTime.dwHighDateTime=0x1d5e7a5, ftLastAccessTime.dwLowDateTime=0x7ff5690, ftLastAccessTime.dwHighDateTime=0x1d5d808, ftLastWriteTime.dwLowDateTime=0x7ff5690, ftLastWriteTime.dwHighDateTime=0x1d5d808, nFileSizeHigh=0x0, nFileSizeLow=0x6e48, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGjKRO.bmp", cAlternateFileName="")) returned 1 [0198.453] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa89f0ac0, ftCreationTime.dwHighDateTime=0x1d5e6fc, ftLastAccessTime.dwLowDateTime=0xe0bf87e0, ftLastAccessTime.dwHighDateTime=0x1d5e3d7, ftLastWriteTime.dwLowDateTime=0xe0bf87e0, ftLastWriteTime.dwHighDateTime=0x1d5e3d7, nFileSizeHigh=0x0, nFileSizeLow=0x28a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="rukJ2ki9DOoDHhK.mp3", cAlternateFileName="RUKJ2K~1.MP3")) returned 1 [0198.453] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0198.454] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x31f5580, ftCreationTime.dwHighDateTime=0x1d5e294, ftLastAccessTime.dwLowDateTime=0xd0dd62b0, ftLastAccessTime.dwHighDateTime=0x1d5dd66, ftLastWriteTime.dwLowDateTime=0xd0dd62b0, ftLastWriteTime.dwHighDateTime=0x1d5dd66, nFileSizeHigh=0x0, nFileSizeLow=0x14645, dwReserved0=0x0, dwReserved1=0x0, cFileName="TgReyANn2kjAJUG9.png", cAlternateFileName="TGREYA~1.PNG")) returned 1 [0198.454] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x65818490, ftCreationTime.dwHighDateTime=0x1d5e493, ftLastAccessTime.dwLowDateTime=0x6af43ce0, ftLastAccessTime.dwHighDateTime=0x1d5de32, ftLastWriteTime.dwLowDateTime=0x6af43ce0, ftLastWriteTime.dwHighDateTime=0x1d5de32, nFileSizeHigh=0x0, nFileSizeLow=0xc74a, dwReserved0=0x0, dwReserved1=0x0, cFileName="tkAF 9Ybmddq50wDQaF.wav", cAlternateFileName="TKAF9Y~1.WAV")) returned 1 [0198.454] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb9717ff0, ftCreationTime.dwHighDateTime=0x1d5dcf1, ftLastAccessTime.dwLowDateTime=0xda373160, ftLastAccessTime.dwHighDateTime=0x1d5dfe6, ftLastWriteTime.dwLowDateTime=0xda373160, ftLastWriteTime.dwHighDateTime=0x1d5dfe6, nFileSizeHigh=0x0, nFileSizeLow=0x7527, dwReserved0=0x0, dwReserved1=0x0, cFileName="tzH31l45.jpg", cAlternateFileName="")) returned 1 [0198.454] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x92470b00, ftCreationTime.dwHighDateTime=0x1d5da3c, ftLastAccessTime.dwLowDateTime=0x36dca210, ftLastAccessTime.dwHighDateTime=0x1d5e2fd, ftLastWriteTime.dwLowDateTime=0x36dca210, ftLastWriteTime.dwHighDateTime=0x1d5e2fd, nFileSizeHigh=0x0, nFileSizeLow=0xbb08, dwReserved0=0x0, dwReserved1=0x0, cFileName="US-VXYmW_QdpRyP4RM1Z.xls", cAlternateFileName="US-VXY~1.XLS")) returned 1 [0198.454] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x89aadc0, ftCreationTime.dwHighDateTime=0x1d5d86c, ftLastAccessTime.dwLowDateTime=0xa9de8de0, ftLastAccessTime.dwHighDateTime=0x1d5e402, ftLastWriteTime.dwLowDateTime=0xa9de8de0, ftLastWriteTime.dwHighDateTime=0x1d5e402, nFileSizeHigh=0x0, nFileSizeLow=0x3c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="vor0Oy7pcXjnQD6PP.swf", cAlternateFileName="VOR0OY~1.SWF")) returned 1 [0198.454] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x35fc1fa0, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x35fc1fa0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x35fc1fa0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPDNSE", cAlternateFileName="")) returned 1 [0198.454] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2baaf60, ftCreationTime.dwHighDateTime=0x1d5ddf6, ftLastAccessTime.dwLowDateTime=0x75b2e5d0, ftLastAccessTime.dwHighDateTime=0x1d5de0c, ftLastWriteTime.dwLowDateTime=0x75b2e5d0, ftLastWriteTime.dwHighDateTime=0x1d5de0c, nFileSizeHigh=0x0, nFileSizeLow=0x7305, dwReserved0=0x0, dwReserved1=0x0, cFileName="wZuI0X8AKAWESBdA.avi", cAlternateFileName="WZUI0X~1.AVI")) returned 1 [0198.455] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcbf8a4a0, ftCreationTime.dwHighDateTime=0x1d5dc97, ftLastAccessTime.dwLowDateTime=0x407045a0, ftLastAccessTime.dwHighDateTime=0x1d5e331, ftLastWriteTime.dwLowDateTime=0x407045a0, ftLastWriteTime.dwHighDateTime=0x1d5e331, nFileSizeHigh=0x0, nFileSizeLow=0x18006, dwReserved0=0x0, dwReserved1=0x0, cFileName="YsijQxuL.wav", cAlternateFileName="")) returned 1 [0198.455] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3c8b92d0, ftCreationTime.dwHighDateTime=0x1d5e51d, ftLastAccessTime.dwLowDateTime=0x3f3caac0, ftLastAccessTime.dwHighDateTime=0x1d5dca6, ftLastWriteTime.dwLowDateTime=0x3f3caac0, ftLastWriteTime.dwHighDateTime=0x1d5dca6, nFileSizeHigh=0x0, nFileSizeLow=0xfd1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="zQJQyNI.pps", cAlternateFileName="")) returned 1 [0198.455] FindNextFileW (in: hFindFile=0x9b2960, lpFindFileData=0x58df148 | out: lpFindFileData=0x58df148*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0198.455] FindClose (in: hFindFile=0x9b2960 | out: hFindFile=0x9b2960) returned 1 [0198.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3d0) returned 1 [0198.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3dc) returned 1 [0198.455] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x58def68, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0198.456] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x58def7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x30 [0198.456] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x58dee1c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0198.456] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Temp.txt", nBufferLength=0x105, lpBuffer=0x58dee30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Temp.txt", lpFilePart=0x0) returned 0x80 [0198.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df324) returned 1 [0198.456] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\Temp.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dirs\\temp.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x4b0 [0198.458] GetFileType (hFile=0x4b0) returned 0x1 [0198.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df320) returned 1 [0198.458] GetFileType (hFile=0x4b0) returned 0x1 [0198.459] WriteFile (in: hFile=0x4b0, lpBuffer=0x2548548*, nNumberOfBytesToWrite=0x49f, lpNumberOfBytesWritten=0x58df3bc, lpOverlapped=0x0 | out: lpBuffer=0x2548548*, lpNumberOfBytesWritten=0x58df3bc*=0x49f, lpOverlapped=0x0) returned 1 [0198.459] CloseHandle (hObject=0x4b0) returned 1 [0198.629] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x58def84, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0198.629] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Wallets\\", nBufferLength=0x105, lpBuffer=0x58def98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Wallets\\", lpFilePart=0x0) returned 0x7b [0198.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df380) returned 1 [0198.629] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Wallets\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\wallets"), fInfoLevelId=0x0, lpFileInformation=0x58df3fc | out: lpFileInformation=0x58df3fc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0198.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df37c) returned 1 [0198.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df380) returned 1 [0198.630] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Wallets" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\wallets"), fInfoLevelId=0x0, lpFileInformation=0x58df3fc | out: lpFileInformation=0x58df3fc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0198.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df37c) returned 1 [0198.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df380) returned 1 [0198.630] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89"), fInfoLevelId=0x0, lpFileInformation=0x58df3fc | out: lpFileInformation=0x58df3fc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0x42ed14d0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x42ed14d0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0198.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df37c) returned 1 [0198.630] CreateDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Wallets" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\wallets"), lpSecurityAttributes=0x0) returned 1 [0198.637] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Zcash", nBufferLength=0x105, lpBuffer=0x58def80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Zcash", lpFilePart=0x0) returned 0x33 [0198.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3dc) returned 1 [0198.637] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Zcash" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\zcash"), fInfoLevelId=0x0, lpFileInformation=0x58df458 | out: lpFileInformation=0x58df458*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0198.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3d8) returned 1 [0198.638] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Armory", nBufferLength=0x105, lpBuffer=0x58def80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Armory", lpFilePart=0x0) returned 0x34 [0198.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3dc) returned 1 [0198.638] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Armory" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\armory"), fInfoLevelId=0x0, lpFileInformation=0x58df458 | out: lpFileInformation=0x58df458*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0198.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3d8) returned 1 [0198.638] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\bytecoin", nBufferLength=0x105, lpBuffer=0x58def80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\bytecoin", lpFilePart=0x0) returned 0x36 [0198.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3dc) returned 1 [0198.638] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\bytecoin" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\bytecoin"), fInfoLevelId=0x0, lpFileInformation=0x58df458 | out: lpFileInformation=0x58df458*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0198.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3d8) returned 1 [0198.638] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\com.liberty.jaxx\\IndexedDB\\file__0.indexeddb.leveldb", nBufferLength=0x105, lpBuffer=0x58def80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\com.liberty.jaxx\\IndexedDB\\file__0.indexeddb.leveldb", lpFilePart=0x0) returned 0x62 [0198.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3dc) returned 1 [0198.638] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\com.liberty.jaxx\\IndexedDB\\file__0.indexeddb.leveldb" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\com.liberty.jaxx\\indexeddb\\file__0.indexeddb.leveldb"), fInfoLevelId=0x0, lpFileInformation=0x58df458 | out: lpFileInformation=0x58df458*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0198.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3d8) returned 1 [0198.638] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\exodus.wallet", nBufferLength=0x105, lpBuffer=0x58def80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\exodus.wallet", lpFilePart=0x0) returned 0x42 [0198.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3dc) returned 1 [0198.638] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\exodus.wallet" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\exodus\\exodus.wallet"), fInfoLevelId=0x0, lpFileInformation=0x58df458 | out: lpFileInformation=0x58df458*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0198.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3d8) returned 1 [0198.639] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore", nBufferLength=0x105, lpBuffer=0x58def80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore", lpFilePart=0x0) returned 0x3f [0198.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3dc) returned 1 [0198.639] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ethereum\\keystore"), fInfoLevelId=0x0, lpFileInformation=0x58df458 | out: lpFileInformation=0x58df458*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0198.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3d8) returned 1 [0198.639] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets", nBufferLength=0x105, lpBuffer=0x58def80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets", lpFilePart=0x0) returned 0x3e [0198.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3dc) returned 1 [0198.639] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\electrum\\wallets"), fInfoLevelId=0x0, lpFileInformation=0x58df458 | out: lpFileInformation=0x58df458*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0198.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3d8) returned 1 [0198.639] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\atomic\\Local Storage\\leveldb", nBufferLength=0x105, lpBuffer=0x58def80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\atomic\\Local Storage\\leveldb", lpFilePart=0x0) returned 0x4a [0198.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3dc) returned 1 [0198.639] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\atomic\\Local Storage\\leveldb" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\atomic\\local storage\\leveldb"), fInfoLevelId=0x0, lpFileInformation=0x58df458 | out: lpFileInformation=0x58df458*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0198.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3d8) returned 1 [0198.639] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Guarda\\Local Storage\\leveldb", nBufferLength=0x105, lpBuffer=0x58def80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Guarda\\Local Storage\\leveldb", lpFilePart=0x0) returned 0x4a [0198.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3dc) returned 1 [0198.640] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Guarda\\Local Storage\\leveldb" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\guarda\\local storage\\leveldb"), fInfoLevelId=0x0, lpFileInformation=0x58df458 | out: lpFileInformation=0x58df458*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0198.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3d8) returned 1 [0198.640] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Coinomi\\Coinomi\\wallets", nBufferLength=0x105, lpBuffer=0x58def80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Coinomi\\Coinomi\\wallets", lpFilePart=0x0) returned 0x43 [0198.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3dc) returned 1 [0198.640] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Coinomi\\Coinomi\\wallets" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\coinomi\\coinomi\\wallets"), fInfoLevelId=0x0, lpFileInformation=0x58df458 | out: lpFileInformation=0x58df458*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0198.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3d8) returned 1 [0198.647] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software", ulOptions=0x0, samDesired=0x20019, phkResult=0x58df438 | out: phkResult=0x58df438*=0x4b0) returned 0x0 [0198.647] RegOpenKeyExW (in: hKey=0x4b0, lpSubKey="Litecoin", ulOptions=0x0, samDesired=0x20019, phkResult=0x58df438 | out: phkResult=0x58df438*=0x0) returned 0x2 [0198.667] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software", ulOptions=0x0, samDesired=0x20019, phkResult=0x58df438 | out: phkResult=0x58df438*=0x47c) returned 0x0 [0198.667] RegOpenKeyExW (in: hKey=0x47c, lpSubKey="Dash", ulOptions=0x0, samDesired=0x20019, phkResult=0x58df438 | out: phkResult=0x58df438*=0x0) returned 0x2 [0198.667] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software", ulOptions=0x0, samDesired=0x20019, phkResult=0x58df438 | out: phkResult=0x58df438*=0x48c) returned 0x0 [0198.667] RegOpenKeyExW (in: hKey=0x48c, lpSubKey="Bitcoin", ulOptions=0x0, samDesired=0x20019, phkResult=0x58df438 | out: phkResult=0x58df438*=0x0) returned 0x2 [0198.668] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x58defa8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0198.668] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Wallets\\", nBufferLength=0x105, lpBuffer=0x58defbc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Wallets\\", lpFilePart=0x0) returned 0x7b [0198.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df408) returned 1 [0198.668] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Wallets\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\wallets"), fInfoLevelId=0x0, lpFileInformation=0x58df488 | out: lpFileInformation=0x58df488*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43fa1030, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43fa1030, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43fa1030, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0198.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df404) returned 1 [0198.669] RemoveDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Wallets\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\wallets")) returned 1 [0198.672] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Authy Desktop\\Local Storage\\leveldb\\", nBufferLength=0x105, lpBuffer=0x58defc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Authy Desktop\\Local Storage\\leveldb\\", lpFilePart=0x0) returned 0x52 [0198.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df420) returned 1 [0198.672] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Authy Desktop\\Local Storage\\leveldb\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\authy desktop\\local storage\\leveldb"), fInfoLevelId=0x0, lpFileInformation=0x58df49c | out: lpFileInformation=0x58df49c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0198.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df41c) returned 1 [0199.674] GetSystemMetrics (nIndex=76) returned 0 [0199.674] GetSystemMetrics (nIndex=77) returned 0 [0199.674] GetSystemMetrics (nIndex=78) returned 1440 [0199.674] GetSystemMetrics (nIndex=79) returned 900 [0199.674] GetSystemMetrics (nIndex=76) returned 0 [0199.674] GetSystemMetrics (nIndex=77) returned 0 [0199.674] GetSystemMetrics (nIndex=78) returned 1440 [0199.674] GetSystemMetrics (nIndex=79) returned 900 [0199.674] GetSystemMetrics (nIndex=76) returned 0 [0199.674] GetSystemMetrics (nIndex=77) returned 0 [0199.674] GetSystemMetrics (nIndex=78) returned 1440 [0199.674] GetSystemMetrics (nIndex=79) returned 900 [0199.674] GetSystemMetrics (nIndex=76) returned 0 [0199.674] GetSystemMetrics (nIndex=77) returned 0 [0199.674] GetSystemMetrics (nIndex=78) returned 1440 [0199.674] GetSystemMetrics (nIndex=79) returned 900 [0200.835] GdiplusStartup (in: token=0x17c468, input=0x58de9b8, output=0x58dea08 | out: token=0x17c468, output=0x58dea08) returned 0x0 [0201.153] GdipCreateBitmapFromScan0 (width=1440, height=900, stride=0, format=0x26200a, scan0=0x0, bitmap=0x58df4ac) returned 0x0 [0201.213] GdipGetImagePixelFormat (image=0x2132230, format=0x58df4b0) returned 0x0 [0201.218] GdipGetImageGraphicsContext (image=0x2132230, graphics=0x58df4bc) returned 0x0 [0201.333] GdipGetImageWidth (image=0x2132230, width=0x58df4b0) returned 0x0 [0201.333] GdipGetImageHeight (image=0x2132230, height=0x58df4b0) returned 0x0 [0201.459] GetDC (hWnd=0x0) returned 0x70106c5 [0201.580] GetCurrentObject (hdc=0x70106c5, type=0x1) returned 0x1b00017 [0201.580] GetCurrentObject (hdc=0x70106c5, type=0x2) returned 0x1900010 [0201.581] GetCurrentObject (hdc=0x70106c5, type=0x7) returned 0x1050032 [0201.581] GetCurrentObject (hdc=0x70106c5, type=0x6) returned 0x18a002e [0201.595] GdipGetDC (graphics=0x2132730, hdc=0x58df444) returned 0x0 [0201.648] BitBlt (hdc=0x60101a0, x=0, y=0, cx=1440, cy=900, hdcSrc=0x70106c5, x1=0, y1=0, rop=0xcc0020) returned 1 [0201.656] GdipReleaseDC (graphics=0x2132730, hdc=0x60101a0) returned 0x0 [0201.662] ReleaseDC (hWnd=0x0, hDC=0x70106c5) returned 1 [0201.857] GdipGetImageEncodersSize (numEncoders=0x58df464, size=0x58df460) returned 0x0 [0201.857] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x9f77e0 [0201.858] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x9f77e0 | out: encoders=0x9f77e0) returned 0x0 [0201.884] LocalFree (hMem=0x9f77e0) returned 0x0 [0202.125] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x58deee8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0202.125] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\screen.jpeg", nBufferLength=0x105, lpBuffer=0x58deefc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\screen.jpeg", lpFilePart=0x0) returned 0x7e [0202.126] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\screen.jpeg", nBufferLength=0x105, lpBuffer=0x58deeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\screen.jpeg", lpFilePart=0x0) returned 0x7e [0202.126] GdipSaveImageToFile (image=0x2132230, filename="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\screen.jpeg", clsidEncoder=0x58df478*(Data1=0x557cf401, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0204.662] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", nBufferLength=0x105, lpBuffer=0x58defb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", lpFilePart=0x0) returned 0x56 [0204.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df418) returned 1 [0204.662] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\login data"), fInfoLevelId=0x0, lpFileInformation=0x58df494 | out: lpFileInformation=0x58df494*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80fc7e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80fc7e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8124f5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4800)) returned 1 [0204.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df414) returned 1 [0204.729] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x58def5c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0204.730] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\", nBufferLength=0x105, lpBuffer=0x58def70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\", lpFilePart=0x0) returned 0x77 [0204.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3cc) returned 1 [0204.730] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dbs"), fInfoLevelId=0x0, lpFileInformation=0x58df448 | out: lpFileInformation=0x58df448*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0204.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3c8) returned 1 [0204.730] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x58def60, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0204.731] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\", nBufferLength=0x105, lpBuffer=0x58def74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\", lpFilePart=0x0) returned 0x77 [0204.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df35c) returned 1 [0204.731] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dbs"), fInfoLevelId=0x0, lpFileInformation=0x58df3d8 | out: lpFileInformation=0x58df3d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0204.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df358) returned 1 [0204.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df35c) returned 1 [0204.731] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dbs"), fInfoLevelId=0x0, lpFileInformation=0x58df3d8 | out: lpFileInformation=0x58df3d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0204.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df358) returned 1 [0204.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df35c) returned 1 [0204.731] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89"), fInfoLevelId=0x0, lpFileInformation=0x58df3d8 | out: lpFileInformation=0x58df3d8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0x456d66b0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x456d66b0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0204.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df358) returned 1 [0204.731] CreateDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dbs"), lpSecurityAttributes=0x0) returned 1 [0204.759] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x58def5c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0204.759] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\", nBufferLength=0x105, lpBuffer=0x58def70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\", lpFilePart=0x0) returned 0x7e [0204.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3cc) returned 1 [0204.759] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dbs\\google"), fInfoLevelId=0x0, lpFileInformation=0x58df448 | out: lpFileInformation=0x58df448*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0204.759] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3c8) returned 1 [0204.759] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x58def60, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0204.760] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\", nBufferLength=0x105, lpBuffer=0x58def74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\", lpFilePart=0x0) returned 0x7e [0204.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df35c) returned 1 [0204.760] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dbs\\google"), fInfoLevelId=0x0, lpFileInformation=0x58df3d8 | out: lpFileInformation=0x58df3d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0204.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df358) returned 1 [0204.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df35c) returned 1 [0204.760] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dbs\\google"), fInfoLevelId=0x0, lpFileInformation=0x58df3d8 | out: lpFileInformation=0x58df3d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0204.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df358) returned 1 [0204.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df35c) returned 1 [0204.760] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dbs"), fInfoLevelId=0x0, lpFileInformation=0x58df3d8 | out: lpFileInformation=0x58df3d8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x46a9fd90, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x46a9fd90, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x46a9fd90, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0204.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df358) returned 1 [0204.760] CreateDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dbs\\google"), lpSecurityAttributes=0x0) returned 1 [0204.761] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", nBufferLength=0x105, lpBuffer=0x58def2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", lpFilePart=0x0) returned 0x56 [0204.761] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x58def18, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0204.761] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Login Data", nBufferLength=0x105, lpBuffer=0x58def2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Login Data", lpFilePart=0x0) returned 0x88 [0204.762] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\login data"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Login Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dbs\\google\\login data"), bFailIfExists=1) returned 1 [0205.088] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", nBufferLength=0x105, lpBuffer=0x58def38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", lpFilePart=0x0) returned 0x56 [0205.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df398) returned 1 [0205.088] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\login data"), fInfoLevelId=0x0, lpFileInformation=0x58df414 | out: lpFileInformation=0x58df414*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80fc7e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80fc7e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8124f5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4800)) returned 1 [0205.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df394) returned 1 [0205.313] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", nBufferLength=0x105, lpBuffer=0x58deecc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", lpFilePart=0x0) returned 0x56 [0205.313] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", nBufferLength=0x105, lpBuffer=0x58dee50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", lpFilePart=0x0) returned 0x56 [0205.430] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", nBufferLength=0x105, lpBuffer=0x58deeac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", lpFilePart=0x0) returned 0x56 [0205.431] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", nBufferLength=0x105, lpBuffer=0x58dee30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", lpFilePart=0x0) returned 0x56 [0205.588] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", nBufferLength=0x105, lpBuffer=0x58dee88, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", lpFilePart=0x0) returned 0x56 [0205.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df2e8) returned 1 [0205.588] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\login data"), fInfoLevelId=0x0, lpFileInformation=0x58df364 | out: lpFileInformation=0x58df364*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80fc7e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80fc7e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8124f5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4800)) returned 1 [0205.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df2e4) returned 1 [0205.588] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", nBufferLength=0x105, lpBuffer=0x58ded90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", lpFilePart=0x0) returned 0x56 [0205.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df284) returned 1 [0205.589] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\login data"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0205.589] GetFileType (hFile=0x378) returned 0x1 [0205.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df280) returned 1 [0205.589] GetFileType (hFile=0x378) returned 0x1 [0205.589] GetFileSize (in: hFile=0x378, lpFileSizeHigh=0x58df444 | out: lpFileSizeHigh=0x58df444*=0x0) returned 0x4800 [0205.590] ReadFile (in: hFile=0x378, lpBuffer=0x245bc60, nNumberOfBytesToRead=0x4800, lpNumberOfBytesRead=0x58df360, lpOverlapped=0x0 | out: lpBuffer=0x245bc60*, lpNumberOfBytesRead=0x58df360*=0x4800, lpOverlapped=0x0) returned 1 [0205.591] CloseHandle (hObject=0x378) returned 1 [0205.599] VarDecCmp (pdecLeft=0x58df480, pdecRight=0x58df470) returned 0x2 [0206.473] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.473] VarDecRound (in: pdecIn=0x58deac4, cDecimals=0, pdecResult=0x58deaa4 | out: pdecResult=0x58deaa4) returned 0x0 [0206.473] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.473] VarDecCmp (pdecLeft=0x58deae4, pdecRight=0x58dead4) returned 0x1 [0206.519] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.519] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.519] VarDecRound (in: pdecIn=0x58deac4, cDecimals=0, pdecResult=0x58deaa4 | out: pdecResult=0x58deaa4) returned 0x0 [0206.521] VarDecCmp (pdecLeft=0x58deae4, pdecRight=0x58dead4) returned 0x1 [0206.521] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.521] VarDecCmp (pdecLeft=0x58deae4, pdecRight=0x58dead4) returned 0x1 [0206.521] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.521] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.521] VarDecCmp (pdecLeft=0x58deae4, pdecRight=0x58dead4) returned 0x1 [0206.521] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.521] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.521] VarDecCmp (pdecLeft=0x58deae4, pdecRight=0x58dead4) returned 0x1 [0206.521] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.521] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.521] VarDecRound (in: pdecIn=0x58deac4, cDecimals=0, pdecResult=0x58deaa4 | out: pdecResult=0x58deaa4) returned 0x0 [0206.521] VarDecCmp (pdecLeft=0x58deae4, pdecRight=0x58dead4) returned 0x1 [0206.521] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.521] VarDecCmp (pdecLeft=0x58deae4, pdecRight=0x58dead4) returned 0x1 [0206.521] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.521] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.521] VarDecCmp (pdecLeft=0x58deae4, pdecRight=0x58dead4) returned 0x1 [0206.521] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.521] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.521] VarDecCmp (pdecLeft=0x58deae4, pdecRight=0x58dead4) returned 0x1 [0206.521] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.521] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.521] VarDecRound (in: pdecIn=0x58deac4, cDecimals=0, pdecResult=0x58deaa4 | out: pdecResult=0x58deaa4) returned 0x0 [0206.521] VarDecCmp (pdecLeft=0x58deae4, pdecRight=0x58dead4) returned 0x1 [0206.521] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.521] VarDecCmp (pdecLeft=0x58deae4, pdecRight=0x58dead4) returned 0x1 [0206.521] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.521] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.521] VarDecCmp (pdecLeft=0x58deae4, pdecRight=0x58dead4) returned 0x1 [0206.521] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.521] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.521] VarDecCmp (pdecLeft=0x58deae4, pdecRight=0x58dead4) returned 0x1 [0206.521] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.521] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.522] VarDecRound (in: pdecIn=0x58deac4, cDecimals=0, pdecResult=0x58deaa4 | out: pdecResult=0x58deaa4) returned 0x0 [0206.522] VarDecCmp (pdecLeft=0x58deae4, pdecRight=0x58dead4) returned 0x1 [0206.522] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.522] VarDecCmp (pdecLeft=0x58deae4, pdecRight=0x58dead4) returned 0x1 [0206.522] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.522] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.522] VarDecCmp (pdecLeft=0x58deae4, pdecRight=0x58dead4) returned 0x1 [0206.522] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.522] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.522] VarDecCmp (pdecLeft=0x58deae4, pdecRight=0x58dead4) returned 0x1 [0206.522] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.522] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.522] VarDecRound (in: pdecIn=0x58deac4, cDecimals=0, pdecResult=0x58deaa4 | out: pdecResult=0x58deaa4) returned 0x0 [0206.522] VarDecCmp (pdecLeft=0x58deae4, pdecRight=0x58dead4) returned 0x1 [0206.522] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.522] VarDecCmp (pdecLeft=0x58deae4, pdecRight=0x58dead4) returned 0x1 [0206.522] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.522] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.522] VarDecCmp (pdecLeft=0x58deae4, pdecRight=0x58dead4) returned 0x1 [0206.522] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.522] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.522] VarDecCmp (pdecLeft=0x58deae4, pdecRight=0x58dead4) returned 0x1 [0206.522] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.522] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.522] VarDecRound (in: pdecIn=0x58deac4, cDecimals=0, pdecResult=0x58deaa4 | out: pdecResult=0x58deaa4) returned 0x0 [0206.522] VarDecCmp (pdecLeft=0x58deae4, pdecRight=0x58dead4) returned 0x1 [0206.522] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.522] VarDecCmp (pdecLeft=0x58deae4, pdecRight=0x58dead4) returned 0x1 [0206.522] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.522] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.522] VarDecCmp (pdecLeft=0x58deae4, pdecRight=0x58dead4) returned 0x1 [0206.522] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.522] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.522] VarDecCmp (pdecLeft=0x58deae4, pdecRight=0x58dead4) returned 0x1 [0206.522] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.522] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.522] VarDecRound (in: pdecIn=0x58deac4, cDecimals=0, pdecResult=0x58deaa4 | out: pdecResult=0x58deaa4) returned 0x0 [0206.522] VarDecCmp (pdecLeft=0x58deae4, pdecRight=0x58dead4) returned 0x1 [0206.522] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.522] VarDecCmp (pdecLeft=0x58deae4, pdecRight=0x58dead4) returned 0x1 [0206.523] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.523] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.523] VarDecCmp (pdecLeft=0x58deae4, pdecRight=0x58dead4) returned 0x1 [0206.523] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.523] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.523] VarDecCmp (pdecLeft=0x58deae4, pdecRight=0x58dead4) returned 0x1 [0206.523] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.523] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.523] VarDecRound (in: pdecIn=0x58deac4, cDecimals=0, pdecResult=0x58deaa4 | out: pdecResult=0x58deaa4) returned 0x0 [0206.523] VarDecCmp (pdecLeft=0x58deae4, pdecRight=0x58dead4) returned 0x1 [0206.523] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.523] VarDecCmp (pdecLeft=0x58deae4, pdecRight=0x58dead4) returned 0x1 [0206.523] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.523] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.523] VarDecCmp (pdecLeft=0x58deae4, pdecRight=0x58dead4) returned 0x1 [0206.523] VarDecRound (in: pdecIn=0x58dea9c, cDecimals=0, pdecResult=0x58deaac | out: pdecResult=0x58deaac) returned 0x0 [0206.605] VarDecRound (in: pdecIn=0x58dee30, cDecimals=0, pdecResult=0x58dee40 | out: pdecResult=0x58dee40) returned 0x0 [0206.605] VarDecRound (in: pdecIn=0x58dee30, cDecimals=0, pdecResult=0x58dee40 | out: pdecResult=0x58dee40) returned 0x0 [0206.837] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", nBufferLength=0x105, lpBuffer=0x58defdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", lpFilePart=0x0) returned 0x53 [0206.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df43c) returned 1 [0206.837] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), fInfoLevelId=0x0, lpFileInformation=0x58df4b8 | out: lpFileInformation=0x58df4b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80d406e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80d406e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x98d1e730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c00)) returned 1 [0206.846] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df438) returned 1 [0206.882] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x58def7c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0206.883] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\", nBufferLength=0x105, lpBuffer=0x58def90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\", lpFilePart=0x0) returned 0x77 [0206.883] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3ec) returned 1 [0206.883] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dbs"), fInfoLevelId=0x0, lpFileInformation=0x58df468 | out: lpFileInformation=0x58df468*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x46a9fd90, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x46a9fd90, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x46a9fd90, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0206.883] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3e8) returned 1 [0206.883] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x58def7c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0206.883] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\", nBufferLength=0x105, lpBuffer=0x58def90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\", lpFilePart=0x0) returned 0x7e [0206.883] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3ec) returned 1 [0206.883] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dbs\\google"), fInfoLevelId=0x0, lpFileInformation=0x58df468 | out: lpFileInformation=0x58df468*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x46a9fd90, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x46a9fd90, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x46a9fd90, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0206.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3e8) returned 1 [0206.884] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", nBufferLength=0x105, lpBuffer=0x58def4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", lpFilePart=0x0) returned 0x53 [0206.884] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x58def38, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0206.884] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Cookies", nBufferLength=0x105, lpBuffer=0x58def4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Cookies", lpFilePart=0x0) returned 0x85 [0206.884] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dbs\\google\\cookies"), bFailIfExists=1) returned 1 [0207.009] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State", nBufferLength=0x105, lpBuffer=0x58def4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State", lpFilePart=0x0) returned 0x4f [0207.009] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x58def38, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0207.009] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Local State", nBufferLength=0x105, lpBuffer=0x58def4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Local State", lpFilePart=0x0) returned 0x89 [0207.009] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\local state"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\Google\\Local State" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\dbs\\google\\local state"), bFailIfExists=1) returned 1 [0207.092] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", nBufferLength=0x105, lpBuffer=0x58def58, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", lpFilePart=0x0) returned 0x53 [0207.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3b8) returned 1 [0207.092] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), fInfoLevelId=0x0, lpFileInformation=0x58df434 | out: lpFileInformation=0x58df434*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80d406e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80d406e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x98d1e730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c00)) returned 1 [0207.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3b4) returned 1 [0207.093] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", nBufferLength=0x105, lpBuffer=0x58deeec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", lpFilePart=0x0) returned 0x53 [0207.093] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", nBufferLength=0x105, lpBuffer=0x58dee70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", lpFilePart=0x0) returned 0x53 [0207.093] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", nBufferLength=0x105, lpBuffer=0x58deecc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", lpFilePart=0x0) returned 0x53 [0207.093] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", nBufferLength=0x105, lpBuffer=0x58dee50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", lpFilePart=0x0) returned 0x53 [0207.093] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", nBufferLength=0x105, lpBuffer=0x58deea8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", lpFilePart=0x0) returned 0x53 [0207.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df308) returned 1 [0207.093] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), fInfoLevelId=0x0, lpFileInformation=0x58df384 | out: lpFileInformation=0x58df384*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80d406e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80d406e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x98d1e730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c00)) returned 1 [0207.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df304) returned 1 [0207.093] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", nBufferLength=0x105, lpBuffer=0x58dedb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", lpFilePart=0x0) returned 0x53 [0207.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df2a4) returned 1 [0207.093] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0207.093] GetFileType (hFile=0x37c) returned 0x1 [0207.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df2a0) returned 1 [0207.094] GetFileType (hFile=0x37c) returned 0x1 [0207.094] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x58df464 | out: lpFileSizeHigh=0x58df464*=0x0) returned 0x1c00 [0207.094] ReadFile (in: hFile=0x37c, lpBuffer=0x25ca460, nNumberOfBytesToRead=0x1c00, lpNumberOfBytesRead=0x58df380, lpOverlapped=0x0 | out: lpBuffer=0x25ca460*, lpNumberOfBytesRead=0x58df380*=0x1c00, lpOverlapped=0x0) returned 1 [0207.094] CloseHandle (hObject=0x37c) returned 1 [0207.094] VarDecCmp (pdecLeft=0x58df4a0, pdecRight=0x58df490) returned 0x2 [0207.094] VarDecRound (in: pdecIn=0x58deabc, cDecimals=0, pdecResult=0x58deacc | out: pdecResult=0x58deacc) returned 0x0 [0207.094] VarDecRound (in: pdecIn=0x58deae4, cDecimals=0, pdecResult=0x58deac4 | out: pdecResult=0x58deac4) returned 0x0 [0207.094] VarDecRound (in: pdecIn=0x58deabc, cDecimals=0, pdecResult=0x58deacc | out: pdecResult=0x58deacc) returned 0x0 [0207.094] VarDecCmp (pdecLeft=0x58deb04, pdecRight=0x58deaf4) returned 0x1 [0207.094] VarDecRound (in: pdecIn=0x58deabc, cDecimals=0, pdecResult=0x58deacc | out: pdecResult=0x58deacc) returned 0x0 [0207.094] VarDecRound (in: pdecIn=0x58deabc, cDecimals=0, pdecResult=0x58deacc | out: pdecResult=0x58deacc) returned 0x0 [0207.094] VarDecRound (in: pdecIn=0x58deae4, cDecimals=0, pdecResult=0x58deac4 | out: pdecResult=0x58deac4) returned 0x0 [0207.094] VarDecCmp (pdecLeft=0x58deb04, pdecRight=0x58deaf4) returned 0x1 [0207.094] VarDecRound (in: pdecIn=0x58deabc, cDecimals=0, pdecResult=0x58deacc | out: pdecResult=0x58deacc) returned 0x0 [0207.094] VarDecCmp (pdecLeft=0x58deb04, pdecRight=0x58deaf4) returned 0x1 [0207.094] VarDecRound (in: pdecIn=0x58deabc, cDecimals=0, pdecResult=0x58deacc | out: pdecResult=0x58deacc) returned 0x0 [0207.094] VarDecRound (in: pdecIn=0x58deabc, cDecimals=0, pdecResult=0x58deacc | out: pdecResult=0x58deacc) returned 0x0 [0207.094] VarDecCmp (pdecLeft=0x58deb04, pdecRight=0x58deaf4) returned 0x1 [0207.094] VarDecRound (in: pdecIn=0x58deabc, cDecimals=0, pdecResult=0x58deacc | out: pdecResult=0x58deacc) returned 0x0 [0207.094] VarDecRound (in: pdecIn=0x58deabc, cDecimals=0, pdecResult=0x58deacc | out: pdecResult=0x58deacc) returned 0x0 [0207.095] VarDecCmp (pdecLeft=0x58deb04, pdecRight=0x58deaf4) returned 0x1 [0207.095] VarDecRound (in: pdecIn=0x58deabc, cDecimals=0, pdecResult=0x58deacc | out: pdecResult=0x58deacc) returned 0x0 [0207.095] VarDecRound (in: pdecIn=0x58deabc, cDecimals=0, pdecResult=0x58deacc | out: pdecResult=0x58deacc) returned 0x0 [0207.095] VarDecRound (in: pdecIn=0x58deae4, cDecimals=0, pdecResult=0x58deac4 | out: pdecResult=0x58deac4) returned 0x0 [0207.095] VarDecCmp (pdecLeft=0x58deb04, pdecRight=0x58deaf4) returned 0x1 [0207.095] VarDecRound (in: pdecIn=0x58deabc, cDecimals=0, pdecResult=0x58deacc | out: pdecResult=0x58deacc) returned 0x0 [0207.095] VarDecCmp (pdecLeft=0x58deb04, pdecRight=0x58deaf4) returned 0x1 [0207.095] VarDecRound (in: pdecIn=0x58deabc, cDecimals=0, pdecResult=0x58deacc | out: pdecResult=0x58deacc) returned 0x0 [0207.095] VarDecRound (in: pdecIn=0x58deabc, cDecimals=0, pdecResult=0x58deacc | out: pdecResult=0x58deacc) returned 0x0 [0207.095] VarDecCmp (pdecLeft=0x58deb04, pdecRight=0x58deaf4) returned 0x1 [0207.095] VarDecRound (in: pdecIn=0x58deabc, cDecimals=0, pdecResult=0x58deacc | out: pdecResult=0x58deacc) returned 0x0 [0207.095] VarDecRound (in: pdecIn=0x58deabc, cDecimals=0, pdecResult=0x58deacc | out: pdecResult=0x58deacc) returned 0x0 [0207.095] VarDecCmp (pdecLeft=0x58deb04, pdecRight=0x58deaf4) returned 0x1 [0207.095] VarDecRound (in: pdecIn=0x58deabc, cDecimals=0, pdecResult=0x58deacc | out: pdecResult=0x58deacc) returned 0x0 [0207.095] VarDecRound (in: pdecIn=0x58deabc, cDecimals=0, pdecResult=0x58deacc | out: pdecResult=0x58deacc) returned 0x0 [0207.095] VarDecRound (in: pdecIn=0x58deae4, cDecimals=0, pdecResult=0x58deac4 | out: pdecResult=0x58deac4) returned 0x0 [0207.095] VarDecCmp (pdecLeft=0x58deb04, pdecRight=0x58deaf4) returned 0x1 [0207.095] VarDecRound (in: pdecIn=0x58deabc, cDecimals=0, pdecResult=0x58deacc | out: pdecResult=0x58deacc) returned 0x0 [0207.095] VarDecCmp (pdecLeft=0x58deb04, pdecRight=0x58deaf4) returned 0x1 [0207.095] VarDecRound (in: pdecIn=0x58deabc, cDecimals=0, pdecResult=0x58deacc | out: pdecResult=0x58deacc) returned 0x0 [0207.095] VarDecRound (in: pdecIn=0x58deabc, cDecimals=0, pdecResult=0x58deacc | out: pdecResult=0x58deacc) returned 0x0 [0207.095] VarDecCmp (pdecLeft=0x58deb04, pdecRight=0x58deaf4) returned 0x1 [0207.095] VarDecRound (in: pdecIn=0x58deabc, cDecimals=0, pdecResult=0x58deacc | out: pdecResult=0x58deacc) returned 0x0 [0207.095] VarDecRound (in: pdecIn=0x58deabc, cDecimals=0, pdecResult=0x58deacc | out: pdecResult=0x58deacc) returned 0x0 [0207.095] VarDecCmp (pdecLeft=0x58deb04, pdecRight=0x58deaf4) returned 0x1 [0207.095] VarDecRound (in: pdecIn=0x58deabc, cDecimals=0, pdecResult=0x58deacc | out: pdecResult=0x58deacc) returned 0x0 [0207.095] VarDecRound (in: pdecIn=0x58deabc, cDecimals=0, pdecResult=0x58deacc | out: pdecResult=0x58deacc) returned 0x0 [0207.095] VarDecRound (in: pdecIn=0x58deae4, cDecimals=0, pdecResult=0x58deac4 | out: pdecResult=0x58deac4) returned 0x0 [0207.095] VarDecCmp (pdecLeft=0x58deb04, pdecRight=0x58deaf4) returned 0x1 [0207.095] VarDecRound (in: pdecIn=0x58deabc, cDecimals=0, pdecResult=0x58deacc | out: pdecResult=0x58deacc) returned 0x0 [0207.095] VarDecCmp (pdecLeft=0x58deb04, pdecRight=0x58deaf4) returned 0x1 [0207.095] VarDecRound (in: pdecIn=0x58deabc, cDecimals=0, pdecResult=0x58deacc | out: pdecResult=0x58deacc) returned 0x0 [0207.095] VarDecRound (in: pdecIn=0x58deabc, cDecimals=0, pdecResult=0x58deacc | out: pdecResult=0x58deacc) returned 0x0 [0207.095] VarDecCmp (pdecLeft=0x58deb04, pdecRight=0x58deaf4) returned 0x1 [0207.095] VarDecRound (in: pdecIn=0x58deabc, cDecimals=0, pdecResult=0x58deacc | out: pdecResult=0x58deacc) returned 0x0 [0207.095] VarDecRound (in: pdecIn=0x58deabc, cDecimals=0, pdecResult=0x58deacc | out: pdecResult=0x58deacc) returned 0x0 [0207.095] VarDecCmp (pdecLeft=0x58deb04, pdecRight=0x58deaf4) returned 0x1 [0207.096] VarDecRound (in: pdecIn=0x58deabc, cDecimals=0, pdecResult=0x58deacc | out: pdecResult=0x58deacc) returned 0x0 [0207.096] VarDecRound (in: pdecIn=0x58deabc, cDecimals=0, pdecResult=0x58deacc | out: pdecResult=0x58deacc) returned 0x0 [0207.096] VarDecRound (in: pdecIn=0x58deae4, cDecimals=0, pdecResult=0x58deac4 | out: pdecResult=0x58deac4) returned 0x0 [0207.096] VarDecCmp (pdecLeft=0x58deb04, pdecRight=0x58deaf4) returned 0x1 [0207.096] VarDecRound (in: pdecIn=0x58deabc, cDecimals=0, pdecResult=0x58deacc | out: pdecResult=0x58deacc) returned 0x0 [0207.096] VarDecCmp (pdecLeft=0x58deb04, pdecRight=0x58deaf4) returned 0x1 [0207.096] VarDecRound (in: pdecIn=0x58deabc, cDecimals=0, pdecResult=0x58deacc | out: pdecResult=0x58deacc) returned 0x0 [0207.096] VarDecRound (in: pdecIn=0x58deabc, cDecimals=0, pdecResult=0x58deacc | out: pdecResult=0x58deacc) returned 0x0 [0207.096] VarDecCmp (pdecLeft=0x58deb04, pdecRight=0x58deaf4) returned 0x1 [0207.096] VarDecRound (in: pdecIn=0x58deabc, cDecimals=0, pdecResult=0x58deacc | out: pdecResult=0x58deacc) returned 0x0 [0207.096] VarDecRound (in: pdecIn=0x58deabc, cDecimals=0, pdecResult=0x58deacc | out: pdecResult=0x58deacc) returned 0x0 [0207.096] VarDecCmp (pdecLeft=0x58deb04, pdecRight=0x58deaf4) returned 0x1 [0207.096] VarDecRound (in: pdecIn=0x58deabc, cDecimals=0, pdecResult=0x58deacc | out: pdecResult=0x58deacc) returned 0x0 [0207.096] VarDecRound (in: pdecIn=0x58deabc, cDecimals=0, pdecResult=0x58deacc | out: pdecResult=0x58deacc) returned 0x0 [0207.096] VarDecRound (in: pdecIn=0x58deae4, cDecimals=0, pdecResult=0x58deac4 | out: pdecResult=0x58deac4) returned 0x0 [0207.096] VarDecCmp (pdecLeft=0x58deb04, pdecRight=0x58deaf4) returned 0x1 [0207.096] VarDecRound (in: pdecIn=0x58deabc, cDecimals=0, pdecResult=0x58deacc | out: pdecResult=0x58deacc) returned 0x0 [0207.096] VarDecCmp (pdecLeft=0x58deb04, pdecRight=0x58deaf4) returned 0x1 [0207.096] VarDecRound (in: pdecIn=0x58deabc, cDecimals=0, pdecResult=0x58deacc | out: pdecResult=0x58deacc) returned 0x0 [0207.096] VarDecRound (in: pdecIn=0x58deabc, cDecimals=0, pdecResult=0x58deacc | out: pdecResult=0x58deacc) returned 0x0 [0207.096] VarDecCmp (pdecLeft=0x58deb04, pdecRight=0x58deaf4) returned 0x1 [0207.096] VarDecRound (in: pdecIn=0x58deabc, cDecimals=0, pdecResult=0x58deacc | out: pdecResult=0x58deacc) returned 0x0 [0207.097] VarDecRound (in: pdecIn=0x58dee50, cDecimals=0, pdecResult=0x58dee60 | out: pdecResult=0x58dee60) returned 0x0 [0207.097] VarDecRound (in: pdecIn=0x58dee50, cDecimals=0, pdecResult=0x58dee60 | out: pdecResult=0x58dee60) returned 0x0 [0207.097] VarDecRound (in: pdecIn=0x58dee50, cDecimals=0, pdecResult=0x58dee60 | out: pdecResult=0x58dee60) returned 0x0 [0207.097] VarDecCmp (pdecLeft=0x58dee98, pdecRight=0x58dee88) returned 0x2 [0207.097] VarDecRound (in: pdecIn=0x58dee50, cDecimals=0, pdecResult=0x58dee60 | out: pdecResult=0x58dee60) returned 0x0 [0207.097] VarDecRound (in: pdecIn=0x58dee50, cDecimals=0, pdecResult=0x58dee60 | out: pdecResult=0x58dee60) returned 0x0 [0207.097] VarDecRound (in: pdecIn=0x58dee78, cDecimals=0, pdecResult=0x58dee58 | out: pdecResult=0x58dee58) returned 0x0 [0207.097] VarDecRound (in: pdecIn=0x58dee78, cDecimals=0, pdecResult=0x58dee58 | out: pdecResult=0x58dee58) returned 0x0 [0207.097] VarDecRound (in: pdecIn=0x58dee50, cDecimals=0, pdecResult=0x58dee60 | out: pdecResult=0x58dee60) returned 0x0 [0207.148] VarDecRound (in: pdecIn=0x58dee50, cDecimals=0, pdecResult=0x58dee60 | out: pdecResult=0x58dee60) returned 0x0 [0207.148] VarDecRound (in: pdecIn=0x58dee50, cDecimals=0, pdecResult=0x58dee60 | out: pdecResult=0x58dee60) returned 0x0 [0207.148] VarDecRound (in: pdecIn=0x58dee50, cDecimals=0, pdecResult=0x58dee60 | out: pdecResult=0x58dee60) returned 0x0 [0207.148] VarDecRound (in: pdecIn=0x58dee50, cDecimals=0, pdecResult=0x58dee60 | out: pdecResult=0x58dee60) returned 0x0 [0207.148] VarDecRound (in: pdecIn=0x58dee50, cDecimals=0, pdecResult=0x58dee60 | out: pdecResult=0x58dee60) returned 0x0 [0207.148] VarDecRound (in: pdecIn=0x58dee50, cDecimals=0, pdecResult=0x58dee60 | out: pdecResult=0x58dee60) returned 0x0 [0207.149] VarDecRound (in: pdecIn=0x58dee50, cDecimals=0, pdecResult=0x58dee60 | out: pdecResult=0x58dee60) returned 0x0 [0207.149] VarDecRound (in: pdecIn=0x58dee50, cDecimals=0, pdecResult=0x58dee60 | out: pdecResult=0x58dee60) returned 0x0 [0207.149] VarDecRound (in: pdecIn=0x58dee50, cDecimals=0, pdecResult=0x58dee60 | out: pdecResult=0x58dee60) returned 0x0 [0207.149] VarDecRound (in: pdecIn=0x58dee50, cDecimals=0, pdecResult=0x58dee60 | out: pdecResult=0x58dee60) returned 0x0 [0207.149] VarDecRound (in: pdecIn=0x58dee50, cDecimals=0, pdecResult=0x58dee60 | out: pdecResult=0x58dee60) returned 0x0 [0207.149] VarDecCmp (pdecLeft=0x58dee98, pdecRight=0x58dee88) returned 0x1 [0207.149] VarDecRound (in: pdecIn=0x58dee50, cDecimals=0, pdecResult=0x58dee60 | out: pdecResult=0x58dee60) returned 0x0 [0207.149] VarDecRound (in: pdecIn=0x58dee50, cDecimals=0, pdecResult=0x58dee60 | out: pdecResult=0x58dee60) returned 0x0 [0207.547] CryptUnprotectData (in: pDataIn=0x58df458, ppszDataDescr=0x0, pOptionalEntropy=0x58df450, pvReserved=0x0, pPromptStruct=0x0, dwFlags=0x1, pDataOut=0x58df460 | out: ppszDataDescr=0x0, pDataOut=0x58df460) returned 1 [0207.590] LocalFree (hMem=0xa01c48) returned 0x0 [0207.608] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", nBufferLength=0x105, lpBuffer=0x58defdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", lpFilePart=0x0) returned 0x54 [0207.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df43c) returned 1 [0207.608] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web data"), fInfoLevelId=0x0, lpFileInformation=0x58df4b8 | out: lpFileInformation=0x58df4b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f86c660, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f86c660, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82d370c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1 [0207.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df438) returned 1 [0207.624] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", nBufferLength=0x105, lpBuffer=0x58def64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", lpFilePart=0x0) returned 0x54 [0207.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df3c4) returned 1 [0207.624] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web data"), fInfoLevelId=0x0, lpFileInformation=0x58df440 | out: lpFileInformation=0x58df440*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f86c660, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f86c660, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82d370c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1 [0207.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df3c0) returned 1 [0207.624] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", nBufferLength=0x105, lpBuffer=0x58deef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", lpFilePart=0x0) returned 0x54 [0207.624] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", nBufferLength=0x105, lpBuffer=0x58dee7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", lpFilePart=0x0) returned 0x54 [0207.624] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", nBufferLength=0x105, lpBuffer=0x58deed8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", lpFilePart=0x0) returned 0x54 [0207.624] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", nBufferLength=0x105, lpBuffer=0x58dee5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", lpFilePart=0x0) returned 0x54 [0207.624] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", nBufferLength=0x105, lpBuffer=0x58deeb4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", lpFilePart=0x0) returned 0x54 [0207.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df314) returned 1 [0207.624] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web data"), fInfoLevelId=0x0, lpFileInformation=0x58df390 | out: lpFileInformation=0x58df390*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f86c660, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f86c660, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82d370c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1 [0207.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df310) returned 1 [0207.625] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", nBufferLength=0x105, lpBuffer=0x58dedbc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", lpFilePart=0x0) returned 0x54 [0207.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x58df2b0) returned 1 [0207.625] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web data"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x298 [0207.625] GetFileType (hFile=0x298) returned 0x1 [0207.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x58df2ac) returned 1 [0207.625] GetFileType (hFile=0x298) returned 0x1 [0207.625] GetFileSize (in: hFile=0x298, lpFileSizeHigh=0x58df470 | out: lpFileSizeHigh=0x58df470*=0x0) returned 0x11000 [0207.627] ReadFile (in: hFile=0x298, lpBuffer=0x25d5378, nNumberOfBytesToRead=0x11000, lpNumberOfBytesRead=0x58df38c, lpOverlapped=0x0 | out: lpBuffer=0x25d5378*, lpNumberOfBytesRead=0x58df38c*=0x11000, lpOverlapped=0x0) returned 1 [0207.638] CloseHandle (hObject=0x298) returned 1 [0207.639] VarDecCmp (pdecLeft=0x58df4ac, pdecRight=0x58df49c) returned 0x2 [0207.639] VarDecRound (in: pdecIn=0x58deac8, cDecimals=0, pdecResult=0x58dead8 | out: pdecResult=0x58dead8) returned 0x0 [0207.639] VarDecRound (in: pdecIn=0x58deaf0, cDecimals=0, pdecResult=0x58dead0 | out: pdecResult=0x58dead0) returned 0x0 [0207.639] VarDecRound (in: pdecIn=0x58deac8, cDecimals=0, pdecResult=0x58dead8 | out: pdecResult=0x58dead8) returned 0x0 [0207.639] VarDecCmp (pdecLeft=0x58deb10, pdecRight=0x58deb00) returned 0x1 [0207.642] VarDecMul (in: pdecLeft=0x58deb10, pdecRight=0x58deb00, pdecResult=0x58dead0 | out: pdecResult=0x58dead0) returned 0x0 [0207.642] VarDecRound (in: pdecIn=0x58deaf0, cDecimals=0, pdecResult=0x58dead0 | out: pdecResult=0x58dead0) returned 0x0 [0207.642] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.642] VarDecRound (in: pdecIn=0x58de17c, cDecimals=0, pdecResult=0x58de15c | out: pdecResult=0x58de15c) returned 0x0 [0207.642] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.642] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x2 [0207.642] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.642] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.642] VarDecRound (in: pdecIn=0x58de17c, cDecimals=0, pdecResult=0x58de15c | out: pdecResult=0x58de15c) returned 0x0 [0207.642] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.642] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.642] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.642] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.642] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.642] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.642] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.642] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.642] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x2 [0207.642] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.642] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.642] VarDecRound (in: pdecIn=0x58de17c, cDecimals=0, pdecResult=0x58de15c | out: pdecResult=0x58de15c) returned 0x0 [0207.642] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.642] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.642] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.642] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.642] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.642] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.642] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.642] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.642] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x2 [0207.642] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.642] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.642] VarDecRound (in: pdecIn=0x58de17c, cDecimals=0, pdecResult=0x58de15c | out: pdecResult=0x58de15c) returned 0x0 [0207.642] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.642] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.642] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.643] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.643] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.643] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.643] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.643] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.643] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x2 [0207.643] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.643] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.643] VarDecRound (in: pdecIn=0x58de17c, cDecimals=0, pdecResult=0x58de15c | out: pdecResult=0x58de15c) returned 0x0 [0207.643] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.643] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.643] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.643] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.643] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.643] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.643] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.643] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.643] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x2 [0207.643] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.643] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.643] VarDecRound (in: pdecIn=0x58de17c, cDecimals=0, pdecResult=0x58de15c | out: pdecResult=0x58de15c) returned 0x0 [0207.643] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.643] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.643] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.643] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.643] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.643] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.643] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.643] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.643] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x2 [0207.643] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.643] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.643] VarDecRound (in: pdecIn=0x58de17c, cDecimals=0, pdecResult=0x58de15c | out: pdecResult=0x58de15c) returned 0x0 [0207.643] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.643] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.643] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.643] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.643] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.643] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.643] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.644] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.644] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x2 [0207.644] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.644] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.644] VarDecRound (in: pdecIn=0x58de17c, cDecimals=0, pdecResult=0x58de15c | out: pdecResult=0x58de15c) returned 0x0 [0207.644] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.644] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.644] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.644] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.644] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.644] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.644] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.644] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.644] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x2 [0207.644] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.644] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.644] VarDecRound (in: pdecIn=0x58de17c, cDecimals=0, pdecResult=0x58de15c | out: pdecResult=0x58de15c) returned 0x0 [0207.644] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.644] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.644] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.644] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.644] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.644] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.644] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.644] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.644] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x2 [0207.644] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.644] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.644] VarDecRound (in: pdecIn=0x58de17c, cDecimals=0, pdecResult=0x58de15c | out: pdecResult=0x58de15c) returned 0x0 [0207.644] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.644] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.644] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.644] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.644] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.644] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.644] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.644] VarDecRound (in: pdecIn=0x58deac8, cDecimals=0, pdecResult=0x58dead8 | out: pdecResult=0x58dead8) returned 0x0 [0207.644] VarDecCmp (pdecLeft=0x58deb10, pdecRight=0x58deb00) returned 0x1 [0207.644] VarDecMul (in: pdecLeft=0x58deb10, pdecRight=0x58deb00, pdecResult=0x58dead0 | out: pdecResult=0x58dead0) returned 0x0 [0207.645] VarDecRound (in: pdecIn=0x58deaf0, cDecimals=0, pdecResult=0x58dead0 | out: pdecResult=0x58dead0) returned 0x0 [0207.645] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.645] VarDecRound (in: pdecIn=0x58de17c, cDecimals=0, pdecResult=0x58de15c | out: pdecResult=0x58de15c) returned 0x0 [0207.645] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.645] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x2 [0207.645] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.645] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.645] VarDecRound (in: pdecIn=0x58de17c, cDecimals=0, pdecResult=0x58de15c | out: pdecResult=0x58de15c) returned 0x0 [0207.645] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.645] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.645] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.645] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.645] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.645] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.645] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.645] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.645] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x2 [0207.645] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.645] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.645] VarDecRound (in: pdecIn=0x58de17c, cDecimals=0, pdecResult=0x58de15c | out: pdecResult=0x58de15c) returned 0x0 [0207.645] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.645] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.645] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.645] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.645] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.645] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.645] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.645] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.646] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x2 [0207.646] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.646] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.646] VarDecRound (in: pdecIn=0x58de17c, cDecimals=0, pdecResult=0x58de15c | out: pdecResult=0x58de15c) returned 0x0 [0207.646] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.646] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.646] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.646] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.646] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.646] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.646] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.646] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.646] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x2 [0207.646] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.646] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.646] VarDecRound (in: pdecIn=0x58de17c, cDecimals=0, pdecResult=0x58de15c | out: pdecResult=0x58de15c) returned 0x0 [0207.646] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.646] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.646] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.646] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.646] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.646] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.646] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.646] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.646] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x2 [0207.646] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.646] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.646] VarDecRound (in: pdecIn=0x58de17c, cDecimals=0, pdecResult=0x58de15c | out: pdecResult=0x58de15c) returned 0x0 [0207.646] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.646] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.646] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.646] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.646] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.646] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.646] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.647] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.647] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x2 [0207.647] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.647] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.647] VarDecRound (in: pdecIn=0x58de17c, cDecimals=0, pdecResult=0x58de15c | out: pdecResult=0x58de15c) returned 0x0 [0207.647] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.647] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.647] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.647] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.647] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.647] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.647] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.647] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.647] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x2 [0207.647] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.647] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.647] VarDecRound (in: pdecIn=0x58de17c, cDecimals=0, pdecResult=0x58de15c | out: pdecResult=0x58de15c) returned 0x0 [0207.647] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.647] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.647] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.647] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.647] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.647] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.647] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.647] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.647] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x2 [0207.647] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.647] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.647] VarDecRound (in: pdecIn=0x58de17c, cDecimals=0, pdecResult=0x58de15c | out: pdecResult=0x58de15c) returned 0x0 [0207.647] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.647] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.647] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.648] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.648] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.648] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.648] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.648] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.648] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x2 [0207.648] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.648] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.648] VarDecRound (in: pdecIn=0x58de17c, cDecimals=0, pdecResult=0x58de15c | out: pdecResult=0x58de15c) returned 0x0 [0207.648] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.648] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.648] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.648] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.648] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.648] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.648] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.648] VarDecRound (in: pdecIn=0x58deac8, cDecimals=0, pdecResult=0x58dead8 | out: pdecResult=0x58dead8) returned 0x0 [0207.648] VarDecMul (in: pdecLeft=0x58deb10, pdecRight=0x58deb00, pdecResult=0x58dead0 | out: pdecResult=0x58dead0) returned 0x0 [0207.648] VarDecRound (in: pdecIn=0x58deaf0, cDecimals=0, pdecResult=0x58dead0 | out: pdecResult=0x58dead0) returned 0x0 [0207.648] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.648] VarDecRound (in: pdecIn=0x58de17c, cDecimals=0, pdecResult=0x58de15c | out: pdecResult=0x58de15c) returned 0x0 [0207.648] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.648] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x2 [0207.648] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.648] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.648] VarDecRound (in: pdecIn=0x58de17c, cDecimals=0, pdecResult=0x58de15c | out: pdecResult=0x58de15c) returned 0x0 [0207.648] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.648] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.648] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.648] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.648] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.648] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.648] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.648] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.649] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x2 [0207.649] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.649] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.649] VarDecRound (in: pdecIn=0x58de17c, cDecimals=0, pdecResult=0x58de15c | out: pdecResult=0x58de15c) returned 0x0 [0207.649] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.649] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.649] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.649] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.649] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.649] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.649] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.649] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.649] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x2 [0207.649] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.649] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.649] VarDecRound (in: pdecIn=0x58de17c, cDecimals=0, pdecResult=0x58de15c | out: pdecResult=0x58de15c) returned 0x0 [0207.649] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.649] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.649] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.649] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.649] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.649] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.649] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.649] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.649] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x2 [0207.649] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.649] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.649] VarDecRound (in: pdecIn=0x58de17c, cDecimals=0, pdecResult=0x58de15c | out: pdecResult=0x58de15c) returned 0x0 [0207.649] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.649] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.649] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.650] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.650] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.650] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.650] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.650] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.650] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x2 [0207.650] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.650] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.650] VarDecRound (in: pdecIn=0x58de17c, cDecimals=0, pdecResult=0x58de15c | out: pdecResult=0x58de15c) returned 0x0 [0207.650] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.650] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.650] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.650] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.650] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.650] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.650] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.650] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.650] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x2 [0207.650] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.650] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.650] VarDecRound (in: pdecIn=0x58de17c, cDecimals=0, pdecResult=0x58de15c | out: pdecResult=0x58de15c) returned 0x0 [0207.650] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.650] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.651] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.651] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.651] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.651] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.651] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.651] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.651] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x2 [0207.651] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.651] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.651] VarDecRound (in: pdecIn=0x58de17c, cDecimals=0, pdecResult=0x58de15c | out: pdecResult=0x58de15c) returned 0x0 [0207.651] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.651] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.651] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.651] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.651] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.651] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.651] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.651] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.651] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x2 [0207.651] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.651] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.651] VarDecRound (in: pdecIn=0x58de17c, cDecimals=0, pdecResult=0x58de15c | out: pdecResult=0x58de15c) returned 0x0 [0207.651] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.651] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.651] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.651] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.651] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.651] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.651] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.651] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.652] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x2 [0207.652] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.652] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.652] VarDecRound (in: pdecIn=0x58de17c, cDecimals=0, pdecResult=0x58de15c | out: pdecResult=0x58de15c) returned 0x0 [0207.652] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.652] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.652] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.652] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.652] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.652] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.652] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.652] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.652] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x2 [0207.652] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.652] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.652] VarDecRound (in: pdecIn=0x58de17c, cDecimals=0, pdecResult=0x58de15c | out: pdecResult=0x58de15c) returned 0x0 [0207.652] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.652] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.652] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.652] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.652] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.652] VarDecCmp (pdecLeft=0x58de19c, pdecRight=0x58de18c) returned 0x1 [0207.652] VarDecRound (in: pdecIn=0x58de154, cDecimals=0, pdecResult=0x58de164 | out: pdecResult=0x58de164) returned 0x0 [0207.653] VarDecRound (in: pdecIn=0x58dee5c, cDecimals=0, pdecResult=0x58dee6c | out: pdecResult=0x58dee6c) returned 0x0 [0207.653] VarDecRound (in: pdecIn=0x58dee5c, cDecimals=0, pdecResult=0x58dee6c | out: pdecResult=0x58dee6c) returned 0x0 [0207.653] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0207.767] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0207.771] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0207.774] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0207.778] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0207.779] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0207.781] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0207.792] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0207.893] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0207.913] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0207.926] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0207.928] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0207.929] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0207.936] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0207.939] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0207.946] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0207.948] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0207.950] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0207.952] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0207.953] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0207.954] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0208.148] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0208.149] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0208.152] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0208.153] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0208.154] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0208.156] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0208.157] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0208.158] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0208.167] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0208.173] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0208.175] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0208.344] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0208.345] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0208.348] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0208.352] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0208.354] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0208.356] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0208.359] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0208.362] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0208.365] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0208.366] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0208.367] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0208.397] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0208.398] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0208.400] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0208.401] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0208.402] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0208.501] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0208.506] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.272] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.289] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.292] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.294] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.298] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.299] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.303] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.307] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.323] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.325] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.345] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.346] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.398] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.409] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.410] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.418] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.419] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.423] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.437] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.439] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.440] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.734] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.736] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.756] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.803] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.680] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.686] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.687] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.688] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.688] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.688] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.688] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.688] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.688] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.689] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.689] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.689] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.689] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.689] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.690] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.690] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.690] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.690] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.690] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.690] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.691] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.691] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.691] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.691] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.691] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.692] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.692] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.692] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.692] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.692] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.692] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.693] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.693] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.693] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.693] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.693] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.693] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.693] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.693] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.693] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.693] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.693] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.693] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.693] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.693] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.693] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.693] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.693] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.693] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.693] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.360] WinHttpGetProxyForUrl (in: hSession=0xa087b0, lpcwszUrl="https://discordapp.com/api/webhooks/762057110061711360/tMRwgjJIsrgovcMF1Yl2bo6leiB0NCQGC_9OK_Y-47-Elvia23Ilr4EIW3bOCjuP8j9a", pAutoProxyOptions=0x58df2d0, pProxyInfo=0x58df340 | out: pProxyInfo=0x58df340) returned 0 [0222.987] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x32c [0222.988] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x348 [0222.988] GetAddrInfoW (in: pNodeName="discordapp.com", pServiceName=0x0, pHints=0x58df240*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x58df1e8 | out: ppResult=0x58df1e8*=0x6076dd0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="discordapp.com", ai_addr=0x6074228*(sa_family=2, sin_port=0x0, sin_addr="162.159.130.233"), ai_next=0x6076e98*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x6074240*(sa_family=2, sin_port=0x0, sin_addr="162.159.133.233"), ai_next=0x6076ec0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x60741f8*(sa_family=2, sin_port=0x0, sin_addr="162.159.129.233"), ai_next=0x6076ee8*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x6074258*(sa_family=2, sin_port=0x0, sin_addr="162.159.135.233"), ai_next=0x6076f10*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x60740a8*(sa_family=2, sin_port=0x0, sin_addr="162.159.134.233"), ai_next=0x0)))))) returned 0 [0222.995] FreeAddrInfoW (pAddrInfo=0x6076dd0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="discordapp.com", ai_addr=0x6074228*(sa_family=2, sin_port=0x0, sin_addr="162.159.130.233"), ai_next=0x6076e98*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x6074240*(sa_family=2, sin_port=0x0, sin_addr="162.159.133.233"), ai_next=0x6076ec0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x60741f8*(sa_family=2, sin_port=0x0, sin_addr="162.159.129.233"), ai_next=0x6076ee8*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x6074258*(sa_family=2, sin_port=0x0, sin_addr="162.159.135.233"), ai_next=0x6076f10*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x60740a8*(sa_family=2, sin_port=0x0, sin_addr="162.159.134.233"), ai_next=0x0)))))) [0222.997] bind (s=0x32c, addr=0x250de6c*(sa_family=2, sin_port=0x0, sin_addr="0.0.0.0"), namelen=16) returned 0 [0223.002] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Threading.OverlappedData_Disabled", lpBuffer=0x58de99c, nSize=0x80 | out: lpBuffer="ꑂ瑢") returned 0x0 [0223.002] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Threading.OverlappedData_MinCount", lpBuffer=0x58de99c, nSize=0x80 | out: lpBuffer="ꑂ瑢") returned 0x0 [0223.003] EtwEventRegister () returned 0x0 [0223.008] WSAIoctl (in: s=0x32c, dwIoControlCode=0xc8000006, lpvInBuffer=0x58df208, cbInBuffer=0x10, lpvOutBuffer=0x58df1f4, cbOutBuffer=0x4, lpcbBytesReturned=0x58df1f0, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x58df1f4, lpcbBytesReturned=0x58df1f0, lpOverlapped=0x0) returned 0 [0223.021] ConnectEx (in: s=0x32c, name=0x250dda4*(sa_family=2, sin_port=0x1bb, sin_addr="162.159.130.233"), namelen=16, lpSendBuffer=0x0, dwSendDataLength=0x0, lpdwBytesSent=0x58df298, lpOverlapped=0x250f254 | out: lpdwBytesSent=0x58df298*=0x0) returned 0 [0223.023] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.027] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.027] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.028] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.028] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.028] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.028] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.028] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.028] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.029] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.029] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.029] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.029] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.030] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.030] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.030] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.030] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.030] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.030] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.031] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.031] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.031] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.031] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.031] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.032] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.032] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.032] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.032] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.032] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.032] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.032] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.032] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.032] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.032] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.032] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.032] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.032] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.032] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.032] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.033] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.033] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.033] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.033] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.033] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.033] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.033] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.033] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.033] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.033] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0223.033] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 Thread: id = 95 os_tid = 0x680 [0194.767] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0194.807] ShellExecuteExW (in: pExecInfo=0x2476254*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="cmd.exe", lpParameters="/C tasklist /FO TABLE > \"C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\processes.txt\"", lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x2476254*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="cmd.exe", lpParameters="/C tasklist /FO TABLE > \"C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\processes.txt\"", lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x4d4)) returned 1 [0195.362] CoGetContextToken (in: pToken=0x526f8c0 | out: pToken=0x526f8c0) returned 0x0 [0195.363] CoUninitialize () Thread: id = 97 os_tid = 0x610 Thread: id = 98 os_tid = 0x5d4 Thread: id = 162 os_tid = 0x770 Thread: id = 170 os_tid = 0x608 [0201.704] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0201.704] CoGetContextToken (in: pToken=0x6a6f534 | out: pToken=0x6a6f534) returned 0x0 [0201.705] CObjectContext::QueryInterface () returned 0x0 [0201.705] CObjectContext::GetCurrentThreadType () returned 0x0 [0201.705] Release () returned 0x0 [0201.705] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0201.705] CoUninitialize () [0201.723] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\discord\\Local Storage\\leveldb\\", nBufferLength=0x105, lpBuffer=0x6a6eb24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\discord\\Local Storage\\leveldb\\", lpFilePart=0x0) returned 0x4c [0201.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ef80) returned 1 [0201.723] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\discord\\Local Storage\\leveldb\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\discord\\local storage\\leveldb"), fInfoLevelId=0x0, lpFileInformation=0x6a6effc | out: lpFileInformation=0x6a6effc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0201.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ef7c) returned 1 [0202.130] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x6a6e8dc | out: lpLuid=0x6a6e8dc*(LowPart=0x14, HighPart=0)) returned 1 [0202.131] GetCurrentProcess () returned 0xffffffff [0202.131] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x6a6e8d8 | out: TokenHandle=0x6a6e8d8*=0x4f0) returned 1 [0202.132] AdjustTokenPrivileges (in: TokenHandle=0x4f0, DisableAllPrivileges=0, NewState=0x254ddc0*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0202.132] CloseHandle (hObject=0x4f0) returned 1 [0202.142] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34298d0, Length=0x20000, ResultLength=0x6a6efb8 | out: SystemInformation=0x34298d0, ResultLength=0x6a6efb8*=0x8608) returned 0x0 [0202.172] CoTaskMemAlloc (cb=0x20c) returned 0x9d5fc8 [0202.172] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x9d5fc8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x0 [0202.172] CoTaskMemFree (pv=0x9d5fc8) [0202.172] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x6a6d358, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpFilePart=0x0) returned 0x2d [0202.184] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\.purple\\accounts.xml", nBufferLength=0x105, lpBuffer=0x6a6eb34, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\.purple\\accounts.xml", lpFilePart=0x0) returned 0x42 [0202.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ef94) returned 1 [0202.184] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\.purple\\accounts.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\.purple\\accounts.xml"), fInfoLevelId=0x0, lpFileInformation=0x6a6f010 | out: lpFileInformation=0x6a6f010*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ef90) returned 1 [0202.196] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Psi+\\profiles\\default\\", nBufferLength=0x105, lpBuffer=0x6a6eb10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Psi+\\profiles\\default\\", lpFilePart=0x0) returned 0x44 [0202.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6efd8) returned 1 [0202.196] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Psi+\\profiles\\default\\", nBufferLength=0x105, lpBuffer=0x6a6eae0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Psi+\\profiles\\default\\", lpFilePart=0x0) returned 0x44 [0202.196] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Psi+\\profiles\\default\\", nBufferLength=0x105, lpBuffer=0x6a6eab4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Psi+\\profiles\\default\\", lpFilePart=0x0) returned 0x44 [0202.196] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Psi+\\profiles\\default\\*", lpFindFileData=0x6a6ed00 | out: lpFindFileData=0x6a6ed00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0202.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ef9c) returned 1 [0202.209] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Psi\\profiles\\default\\", nBufferLength=0x105, lpBuffer=0x6a6eb10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Psi\\profiles\\default\\", lpFilePart=0x0) returned 0x43 [0202.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6efd8) returned 1 [0202.209] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Psi\\profiles\\default\\", nBufferLength=0x105, lpBuffer=0x6a6eae0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Psi\\profiles\\default\\", lpFilePart=0x0) returned 0x43 [0202.210] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Psi\\profiles\\default\\", nBufferLength=0x105, lpBuffer=0x6a6eab4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Psi\\profiles\\default\\", lpFilePart=0x0) returned 0x43 [0202.210] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Psi\\profiles\\default\\*", lpFindFileData=0x6a6ed00 | out: lpFindFileData=0x6a6ed00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0202.210] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ef9c) returned 1 [0202.215] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Skype for Desktop", nBufferLength=0x105, lpBuffer=0x6a6eb20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Skype for Desktop", lpFilePart=0x0) returned 0x49 [0202.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ef7c) returned 1 [0202.215] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Skype for Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\skype for desktop"), fInfoLevelId=0x0, lpFileInformation=0x6a6eff8 | out: lpFileInformation=0x6a6eff8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0202.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ef78) returned 1 [0202.381] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", nBufferLength=0x105, lpBuffer=0x6a6ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", lpFilePart=0x0) returned 0x46 [0202.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee84) returned 1 [0202.382] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles"), fInfoLevelId=0x0, lpFileInformation=0x6a6ef00 | out: lpFileInformation=0x6a6ef00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0202.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee80) returned 1 [0202.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ef00) returned 1 [0202.910] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", nBufferLength=0x105, lpBuffer=0x6a6ea08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", lpFilePart=0x0) returned 0x46 [0202.910] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\", nBufferLength=0x105, lpBuffer=0x6a6e9dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\", lpFilePart=0x0) returned 0x47 [0202.910] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*", lpFindFileData=0x6a6ec28 | out: lpFindFileData=0x6a6ec28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0202.911] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec38 | out: lpFindFileData=0x6a6ec38*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0202.911] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec38 | out: lpFindFileData=0x6a6ec38*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 1 [0202.911] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec38 | out: lpFindFileData=0x6a6ec38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0202.911] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0202.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6eec0) returned 1 [0202.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6eecc) returned 1 [0202.911] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\logins.json", nBufferLength=0x105, lpBuffer=0x6a6ea30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\logins.json", lpFilePart=0x0) returned 0x63 [0202.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee90) returned 1 [0202.911] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\logins.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\logins.json"), fInfoLevelId=0x0, lpFileInformation=0x6a6ef0c | out: lpFileInformation=0x6a6ef0c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0203.245] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee8c) returned 1 [0203.245] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\key4.db", nBufferLength=0x105, lpBuffer=0x6a6ea30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\key4.db", lpFilePart=0x0) returned 0x5f [0203.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee90) returned 1 [0203.245] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\key4.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\key4.db"), fInfoLevelId=0x0, lpFileInformation=0x6a6ef0c | out: lpFileInformation=0x6a6ef0c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0203.245] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee8c) returned 1 [0203.246] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\places.SQLiteHandler", nBufferLength=0x105, lpBuffer=0x6a6ea30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\places.SQLiteHandler", lpFilePart=0x0) returned 0x6c [0203.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee90) returned 1 [0203.246] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\places.SQLiteHandler" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\places.sqlitehandler"), fInfoLevelId=0x0, lpFileInformation=0x6a6ef0c | out: lpFileInformation=0x6a6ef0c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0203.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee8c) returned 1 [0203.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6efac) returned 1 [0203.587] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", nBufferLength=0x105, lpBuffer=0x6a6eab4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", lpFilePart=0x0) returned 0x46 [0203.587] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\", nBufferLength=0x105, lpBuffer=0x6a6ea88, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\", lpFilePart=0x0) returned 0x47 [0203.587] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*", lpFindFileData=0x6a6ecd4 | out: lpFindFileData=0x6a6ecd4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0203.587] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ece4 | out: lpFindFileData=0x6a6ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0203.587] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ece4 | out: lpFindFileData=0x6a6ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 1 [0203.587] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ece4 | out: lpFindFileData=0x6a6ece4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0203.588] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0203.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ef6c) returned 1 [0203.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ef78) returned 1 [0203.596] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x6a6d74c, nSize=0x64 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x1e [0203.596] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x6a6d74c, nSize=0x64 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x1e [0203.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eef8) returned 1 [0203.742] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x6a6ea00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", lpFilePart=0x0) returned 0x2b [0203.742] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", nBufferLength=0x105, lpBuffer=0x6a6e9d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", lpFilePart=0x0) returned 0x2c [0203.742] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\*", lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0203.743] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0203.743] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0203.743] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0203.743] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apps", cAlternateFileName="")) returned 1 [0203.743] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 1 [0203.743] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66051ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x66051ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9791f220, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x1a918, dwReserved0=0x0, dwReserved1=0x0, cFileName="GDIPFONTCACHEV1.DAT", cAlternateFileName="GDIPFO~1.DAT")) returned 1 [0203.743] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google", cAlternateFileName="")) returned 1 [0203.744] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29175f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29175f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29175f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0203.744] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x8de8eaa0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x126da7, dwReserved0=0x0, dwReserved1=0x0, cFileName="IconCache.db", cAlternateFileName="ICONCA~1.DB")) returned 1 [0203.744] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0203.744] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1 [0203.744] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0203.744] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x35fc1fa0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x35fc1fa0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0203.744] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29175f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29175f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29175f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0203.744] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 1 [0203.745] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0203.745] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0203.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6eeb8) returned 1 [0203.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6eec4) returned 1 [0203.745] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe", nBufferLength=0x105, lpBuffer=0x6a6ea20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe", lpFilePart=0x0) returned 0x31 [0203.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eee8) returned 1 [0203.745] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe", nBufferLength=0x105, lpBuffer=0x6a6e9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe", lpFilePart=0x0) returned 0x31 [0203.745] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\", nBufferLength=0x105, lpBuffer=0x6a6e9c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\", lpFilePart=0x0) returned 0x32 [0203.745] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\*", lpFindFileData=0x6a6ec10 | out: lpFindFileData=0x6a6ec10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0203.860] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0203.860] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0203.860] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 1 [0203.861] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 0 [0203.861] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0203.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6eea8) returned 1 [0203.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6eeb4) returned 1 [0203.861] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\.", nBufferLength=0x105, lpBuffer=0x6a6e9a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe", lpFilePart=0x0) returned 0x31 [0203.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee88) returned 1 [0203.861] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe", nBufferLength=0x105, lpBuffer=0x6a6e990, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe", lpFilePart=0x0) returned 0x31 [0203.861] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\", nBufferLength=0x105, lpBuffer=0x6a6e964, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\", lpFilePart=0x0) returned 0x32 [0203.861] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\*", lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0203.861] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0203.862] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0203.862] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 1 [0203.862] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0203.862] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0203.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee48) returned 1 [0203.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee54) returned 1 [0203.862] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x39 [0203.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0203.862] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x39 [0203.862] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x3a [0203.862] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0203.863] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0203.863] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0203.863] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 0 [0203.863] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0203.863] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0203.863] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0203.863] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x39 [0203.863] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0203.863] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x39 [0203.863] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x3a [0203.864] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0203.864] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0203.864] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0203.864] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0203.864] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0203.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0203.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0203.864] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x3e [0203.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0203.864] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x3e [0203.864] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\", lpFilePart=0x0) returned 0x3f [0203.864] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0204.064] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.064] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x892c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCMapFnt10.lst", cAlternateFileName="ADOBEC~1.LST")) returned 1 [0204.064] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xd9c071a0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x21cdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeSysFnt10.lst", cAlternateFileName="ADOBES~1.LST")) returned 1 [0204.064] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1 [0204.064] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd3b286a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd3b286a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xee0c3750, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharedDataEvents", cAlternateFileName="SHARED~1")) returned 1 [0204.065] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 1 [0204.065] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0204.065] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0204.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0204.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0204.066] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x3e [0204.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0204.066] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x3e [0204.066] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\", lpFilePart=0x0) returned 0x3f [0204.066] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0204.067] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.067] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x892c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCMapFnt10.lst", cAlternateFileName="ADOBEC~1.LST")) returned 1 [0204.067] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xd9c071a0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x21cdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeSysFnt10.lst", cAlternateFileName="ADOBES~1.LST")) returned 1 [0204.067] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1 [0204.068] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd3b286a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd3b286a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xee0c3750, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharedDataEvents", cAlternateFileName="SHARED~1")) returned 1 [0204.068] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 1 [0204.068] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 0 [0204.068] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0204.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0204.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0204.069] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache", lpFilePart=0x0) returned 0x44 [0204.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0204.069] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache", lpFilePart=0x0) returned 0x44 [0204.069] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\", lpFilePart=0x0) returned 0x45 [0204.069] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0204.120] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.120] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xcfc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroFnt10.lst", cAlternateFileName="ACROFN~1.LST")) returned 1 [0204.120] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0204.120] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0204.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0204.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0204.121] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache", lpFilePart=0x0) returned 0x44 [0204.121] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color", lpFilePart=0x0) returned 0x37 [0204.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0204.121] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color", lpFilePart=0x0) returned 0x37 [0204.121] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\", lpFilePart=0x0) returned 0x38 [0204.121] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0204.121] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.121] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce719dc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x49c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACECache11.lst", cAlternateFileName="ACECAC~1.LST")) returned 1 [0204.121] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1 [0204.122] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 0 [0204.122] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0204.122] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0204.122] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0204.122] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color", lpFilePart=0x0) returned 0x37 [0204.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0204.122] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color", lpFilePart=0x0) returned 0x37 [0204.122] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\", lpFilePart=0x0) returned 0x38 [0204.122] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0204.122] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.123] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce719dc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x49c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACECache11.lst", cAlternateFileName="ACECAC~1.LST")) returned 1 [0204.123] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1 [0204.123] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0204.123] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0204.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0204.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0204.123] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles", lpFilePart=0x0) returned 0x40 [0204.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0204.123] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles", lpFilePart=0x0) returned 0x40 [0204.123] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\", lpFilePart=0x0) returned 0x41 [0204.123] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0204.127] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.128] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x102a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wscRGB.icc", cAlternateFileName="")) returned 1 [0204.128] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0x0, dwReserved1=0x0, cFileName="wsRGB.icc", cAlternateFileName="")) returned 1 [0204.128] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0204.128] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0204.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0204.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0204.128] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles", lpFilePart=0x0) returned 0x40 [0204.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0204.129] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles", lpFilePart=0x0) returned 0x40 [0204.129] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\", lpFilePart=0x0) returned 0x41 [0204.129] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0204.129] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.129] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x102a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wscRGB.icc", cAlternateFileName="")) returned 1 [0204.129] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0x0, dwReserved1=0x0, cFileName="wsRGB.icc", cAlternateFileName="")) returned 1 [0204.129] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0x0, dwReserved1=0x0, cFileName="wsRGB.icc", cAlternateFileName="")) returned 0 [0204.129] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0204.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0204.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0204.130] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data", nBufferLength=0x105, lpBuffer=0x6a6ea20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data", lpFilePart=0x0) returned 0x3c [0204.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eee8) returned 1 [0204.130] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data", nBufferLength=0x105, lpBuffer=0x6a6e9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data", lpFilePart=0x0) returned 0x3c [0204.130] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\", nBufferLength=0x105, lpBuffer=0x6a6e9c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\", lpFilePart=0x0) returned 0x3d [0204.130] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\*", lpFindFileData=0x6a6ec10 | out: lpFindFileData=0x6a6ec10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0204.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6eeac) returned 1 [0204.132] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps", nBufferLength=0x105, lpBuffer=0x6a6ea20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps", lpFilePart=0x0) returned 0x30 [0204.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eee8) returned 1 [0204.132] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps", nBufferLength=0x105, lpBuffer=0x6a6e9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps", lpFilePart=0x0) returned 0x30 [0204.132] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\", nBufferLength=0x105, lpBuffer=0x6a6e9c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\", lpFilePart=0x0) returned 0x31 [0204.132] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\*", lpFindFileData=0x6a6ec10 | out: lpFindFileData=0x6a6ec10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0204.137] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.138] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0", cAlternateFileName="")) returned 1 [0204.138] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0", cAlternateFileName="")) returned 0 [0204.138] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0204.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6eea8) returned 1 [0204.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6eeb4) returned 1 [0204.138] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\.", nBufferLength=0x105, lpBuffer=0x6a6e9a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps", lpFilePart=0x0) returned 0x30 [0204.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee88) returned 1 [0204.138] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps", nBufferLength=0x105, lpBuffer=0x6a6e990, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps", lpFilePart=0x0) returned 0x30 [0204.138] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\", nBufferLength=0x105, lpBuffer=0x6a6e964, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\", lpFilePart=0x0) returned 0x31 [0204.138] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\*", lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0204.139] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.139] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0", cAlternateFileName="")) returned 1 [0204.139] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0204.139] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0204.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee48) returned 1 [0204.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee54) returned 1 [0204.139] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0", lpFilePart=0x0) returned 0x34 [0204.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0204.139] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0", lpFilePart=0x0) returned 0x34 [0204.139] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\", lpFilePart=0x0) returned 0x35 [0204.139] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0204.140] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.141] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 1 [0204.141] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DQQ19BCJ.JAX", cAlternateFileName="")) returned 1 [0204.141] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DQQ19BCJ.JAX", cAlternateFileName="")) returned 0 [0204.141] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0204.141] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0204.141] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0204.141] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0", lpFilePart=0x0) returned 0x34 [0204.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0204.142] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0", lpFilePart=0x0) returned 0x34 [0204.142] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\", lpFilePart=0x0) returned 0x35 [0204.142] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0204.142] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.143] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 1 [0204.143] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DQQ19BCJ.JAX", cAlternateFileName="")) returned 1 [0204.143] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0204.143] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0204.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0204.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0204.143] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data", lpFilePart=0x0) returned 0x39 [0204.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0204.143] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data", lpFilePart=0x0) returned 0x39 [0204.143] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\", lpFilePart=0x0) returned 0x3a [0204.144] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0204.151] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.151] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CJW3O3KP.BX7", cAlternateFileName="")) returned 1 [0204.151] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CJW3O3KP.BX7", cAlternateFileName="")) returned 0 [0204.151] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0204.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0204.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0204.151] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data", lpFilePart=0x0) returned 0x39 [0204.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0204.151] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data", lpFilePart=0x0) returned 0x39 [0204.152] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\", lpFilePart=0x0) returned 0x3a [0204.152] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0204.152] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.152] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CJW3O3KP.BX7", cAlternateFileName="")) returned 1 [0204.152] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0204.152] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0204.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0204.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0204.152] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7", lpFilePart=0x0) returned 0x46 [0204.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0204.152] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7", lpFilePart=0x0) returned 0x46 [0204.153] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\", lpFilePart=0x0) returned 0x47 [0204.153] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0204.154] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.155] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6NG60CXZ.9GJ", cAlternateFileName="")) returned 1 [0204.155] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6NG60CXZ.9GJ", cAlternateFileName="")) returned 0 [0204.155] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0204.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0204.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0204.155] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7", lpFilePart=0x0) returned 0x46 [0204.155] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX", lpFilePart=0x0) returned 0x41 [0204.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0204.155] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX", lpFilePart=0x0) returned 0x41 [0204.155] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\", lpFilePart=0x0) returned 0x42 [0204.155] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0204.156] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.187] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="YVORLGOR.PNT", cAlternateFileName="")) returned 1 [0204.187] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="YVORLGOR.PNT", cAlternateFileName="")) returned 0 [0204.187] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0204.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0204.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0204.187] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX", lpFilePart=0x0) returned 0x41 [0204.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0204.187] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX", lpFilePart=0x0) returned 0x41 [0204.187] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\", lpFilePart=0x0) returned 0x42 [0204.187] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0204.188] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.188] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="YVORLGOR.PNT", cAlternateFileName="")) returned 1 [0204.188] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0204.188] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0204.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0204.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0204.188] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT", lpFilePart=0x0) returned 0x4e [0204.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0204.188] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT", lpFilePart=0x0) returned 0x4e [0204.188] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\", lpFilePart=0x0) returned 0x4f [0204.188] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0204.432] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.432] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715", cAlternateFileName="CLICEX~1.000")) returned 1 [0204.432] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 1 [0204.432] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifests", cAlternateFileName="MANIFE~1")) returned 1 [0204.432] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifests", cAlternateFileName="MANIFE~1")) returned 0 [0204.432] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0204.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0204.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0204.433] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT", lpFilePart=0x0) returned 0x4e [0204.433] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment", nBufferLength=0x105, lpBuffer=0x6a6ea20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment", lpFilePart=0x0) returned 0x36 [0204.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eee8) returned 1 [0204.434] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment", nBufferLength=0x105, lpBuffer=0x6a6e9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment", lpFilePart=0x0) returned 0x36 [0204.434] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\", nBufferLength=0x105, lpBuffer=0x6a6e9c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\", lpFilePart=0x0) returned 0x37 [0204.434] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\*", lpFindFileData=0x6a6ec10 | out: lpFindFileData=0x6a6ec10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0204.472] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.472] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0204.473] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0204.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6eea8) returned 1 [0204.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6eeb4) returned 1 [0204.473] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\.", nBufferLength=0x105, lpBuffer=0x6a6e9a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment", lpFilePart=0x0) returned 0x36 [0204.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee88) returned 1 [0204.473] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment", nBufferLength=0x105, lpBuffer=0x6a6e990, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment", lpFilePart=0x0) returned 0x36 [0204.473] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\", nBufferLength=0x105, lpBuffer=0x6a6e964, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\", lpFilePart=0x0) returned 0x37 [0204.473] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\*", lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0204.473] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.474] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0204.474] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0204.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee48) returned 1 [0204.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee54) returned 1 [0204.474] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google", nBufferLength=0x105, lpBuffer=0x6a6ea20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google", lpFilePart=0x0) returned 0x32 [0204.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eee8) returned 1 [0204.474] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google", nBufferLength=0x105, lpBuffer=0x6a6e9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google", lpFilePart=0x0) returned 0x32 [0204.474] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\", nBufferLength=0x105, lpBuffer=0x6a6e9c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\", lpFilePart=0x0) returned 0x33 [0204.474] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\*", lpFindFileData=0x6a6ec10 | out: lpFindFileData=0x6a6ec10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0204.474] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.475] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Chrome", cAlternateFileName="")) returned 1 [0204.475] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 1 [0204.475] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 0 [0204.475] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0204.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6eea8) returned 1 [0204.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6eeb4) returned 1 [0204.475] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\.", nBufferLength=0x105, lpBuffer=0x6a6e9a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google", lpFilePart=0x0) returned 0x32 [0204.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee88) returned 1 [0204.475] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google", nBufferLength=0x105, lpBuffer=0x6a6e990, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google", lpFilePart=0x0) returned 0x32 [0204.475] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\", nBufferLength=0x105, lpBuffer=0x6a6e964, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\", lpFilePart=0x0) returned 0x33 [0204.475] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\*", lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0204.476] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.476] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Chrome", cAlternateFileName="")) returned 1 [0204.476] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 1 [0204.476] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0204.476] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0204.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee48) returned 1 [0204.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee54) returned 1 [0204.476] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome", lpFilePart=0x0) returned 0x39 [0204.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0204.476] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome", lpFilePart=0x0) returned 0x39 [0204.477] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\", lpFilePart=0x0) returned 0x3a [0204.477] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0204.477] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.477] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Data", cAlternateFileName="USERDA~1")) returned 1 [0204.477] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Data", cAlternateFileName="USERDA~1")) returned 0 [0204.477] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0204.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0204.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0204.478] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome", lpFilePart=0x0) returned 0x39 [0204.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0204.478] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome", lpFilePart=0x0) returned 0x39 [0204.478] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\", lpFilePart=0x0) returned 0x3a [0204.478] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0204.478] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.478] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Data", cAlternateFileName="USERDA~1")) returned 1 [0204.478] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0204.478] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0204.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0204.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0204.479] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data", lpFilePart=0x0) returned 0x43 [0204.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0204.479] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data", lpFilePart=0x0) returned 0x43 [0204.479] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\", lpFilePart=0x0) returned 0x44 [0204.479] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0204.480] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.485] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CertificateTransparency", cAlternateFileName="CERTIF~1")) returned 1 [0204.485] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crashpad", cAlternateFileName="")) returned 1 [0204.486] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c4887c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c4887c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0204.486] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVWhitelist", cAlternateFileName="EVWHIT~1")) returned 1 [0204.486] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileTypePolicies", cAlternateFileName="FILETY~1")) returned 1 [0204.486] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f8b8920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f8b8920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f8b8920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="First Run", cAlternateFileName="FIRSTR~1")) returned 1 [0204.486] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85749110, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c0bcce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0bf3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1082a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local State", cAlternateFileName="LOCALS~1")) returned 1 [0204.486] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OriginTrials", cAlternateFileName="ORIGIN~1")) returned 1 [0204.486] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PepperFlash", cAlternateFileName="PEPPER~1")) returned 1 [0204.487] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e47510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e47510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pnacl", cAlternateFileName="")) returned 1 [0204.487] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x97f6e8b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Channel IDs", cAlternateFileName="SAFEBR~3")) returned 1 [0204.487] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x97f94a10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Channel IDs-journal", cAlternateFileName="SAFEBR~4")) returned 1 [0204.487] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8582d950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8582d950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Cookies", cAlternateFileName="SAFEBR~1")) returned 1 [0204.487] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8582d950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8582d950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Cookies-journal", cAlternateFileName="SAFEBR~2")) returned 1 [0204.487] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SSLErrorAssistant", cAlternateFileName="SSLERR~1")) returned 1 [0204.488] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SwReporter", cAlternateFileName="SWREPO~1")) returned 1 [0204.488] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 1 [0204.488] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 0 [0204.488] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0204.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0204.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0204.488] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data", lpFilePart=0x0) returned 0x43 [0204.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0204.488] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data", lpFilePart=0x0) returned 0x43 [0204.488] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\", lpFilePart=0x0) returned 0x44 [0204.489] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0204.489] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.489] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CertificateTransparency", cAlternateFileName="CERTIF~1")) returned 1 [0204.489] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crashpad", cAlternateFileName="")) returned 1 [0204.489] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c4887c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c4887c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0204.489] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVWhitelist", cAlternateFileName="EVWHIT~1")) returned 1 [0204.489] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileTypePolicies", cAlternateFileName="FILETY~1")) returned 1 [0204.490] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f8b8920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f8b8920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f8b8920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="First Run", cAlternateFileName="FIRSTR~1")) returned 1 [0204.490] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85749110, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c0bcce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0bf3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1082a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local State", cAlternateFileName="LOCALS~1")) returned 1 [0204.490] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OriginTrials", cAlternateFileName="ORIGIN~1")) returned 1 [0204.490] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PepperFlash", cAlternateFileName="PEPPER~1")) returned 1 [0204.490] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e47510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e47510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pnacl", cAlternateFileName="")) returned 1 [0204.490] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x97f6e8b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Channel IDs", cAlternateFileName="SAFEBR~3")) returned 1 [0204.491] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x97f94a10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Channel IDs-journal", cAlternateFileName="SAFEBR~4")) returned 1 [0204.491] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8582d950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8582d950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Cookies", cAlternateFileName="SAFEBR~1")) returned 1 [0204.491] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8582d950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8582d950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Cookies-journal", cAlternateFileName="SAFEBR~2")) returned 1 [0204.491] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SSLErrorAssistant", cAlternateFileName="SSLERR~1")) returned 1 [0204.491] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SwReporter", cAlternateFileName="SWREPO~1")) returned 1 [0204.491] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 1 [0204.491] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0204.492] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0204.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0204.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0204.492] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency", lpFilePart=0x0) returned 0x5b [0204.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0204.492] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency", lpFilePart=0x0) returned 0x5b [0204.492] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\", lpFilePart=0x0) returned 0x5c [0204.492] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0204.513] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.513] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0204.513] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0204.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0204.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0204.513] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency", lpFilePart=0x0) returned 0x5b [0204.513] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad", lpFilePart=0x0) returned 0x4c [0204.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0204.514] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad", lpFilePart=0x0) returned 0x4c [0204.514] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\", lpFilePart=0x0) returned 0x4d [0204.514] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0204.517] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.517] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f5beda0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="metadata", cAlternateFileName="")) returned 1 [0204.517] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f598c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="reports", cAlternateFileName="")) returned 1 [0204.517] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3a6374a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0204.517] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0204.517] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0204.517] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0204.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0204.518] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad", lpFilePart=0x0) returned 0x4c [0204.518] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default", lpFilePart=0x0) returned 0x4b [0204.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0204.518] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default", lpFilePart=0x0) returned 0x4b [0204.518] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", lpFilePart=0x0) returned 0x4c [0204.518] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c4887c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c4887c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0204.533] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c4887c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c4887c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.554] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1 [0204.641] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80d406e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80d406e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x98d1e730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0204.642] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80d66840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80d66840, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x98d44890, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cookies-journal", cAlternateFileName="COOKIE~1")) returned 1 [0204.642] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83b08a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83b08a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0b57b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Current Session", cAlternateFileName="CURREN~1")) returned 1 [0204.642] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c3b6860, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c3b6860, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c3b8f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x126, dwReserved0=0x0, dwReserved1=0x0, cFileName="Current Tabs", cAlternateFileName="CURREN~2")) returned 1 [0204.642] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80916060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80916060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="data_reduction_proxy_leveldb", cAlternateFileName="DATA_R~1")) returned 1 [0204.642] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82bed750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82bed750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Extension Rules", cAlternateFileName="EXTENS~3")) returned 1 [0204.642] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82556720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82556720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Extension State", cAlternateFileName="EXTENS~2")) returned 1 [0204.643] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Extensions", cAlternateFileName="EXTENS~1")) returned 1 [0204.643] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80cce2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80cce2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80db2b00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favicons", cAlternateFileName="")) returned 1 [0204.643] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80cce2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80cce2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80e97340, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favicons-journal", cAlternateFileName="FAVICO~1")) returned 1 [0204.643] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81c321d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81c321d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81c58330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b2e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Profile.ico", cAlternateFileName="GOOGLE~1.ICO")) returned 1 [0204.643] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802fc800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802fc800, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87f47590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19000, dwReserved0=0x0, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0204.643] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824d3190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824d3190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c3b6860, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x142f, dwReserved0=0x0, dwReserved1=0x0, cFileName="History Provider Cache", cAlternateFileName="HISTOR~2")) returned 1 [0204.643] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802fc800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802fc800, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87f6d6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History-journal", cAlternateFileName="HISTOR~1")) returned 1 [0204.644] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JumpListIcons", cAlternateFileName="JUMPLI~2")) returned 1 [0204.644] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JumpListIconsOld", cAlternateFileName="JUMPLI~1")) returned 1 [0204.644] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local Extension Settings", cAlternateFileName="LOCALE~1")) returned 1 [0204.644] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83ede170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x90191d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x90191d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local Storage", cAlternateFileName="LOCALS~1")) returned 1 [0204.644] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80fc7e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80fc7e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8124f5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Login Data", cAlternateFileName="LOGIND~1")) returned 1 [0204.644] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80fc7e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80fc7e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8129b860, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Login Data-journal", cAlternateFileName="LOGIND~2")) returned 1 [0204.644] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82330270, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82330270, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x825f0410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network Action Predictor", cAlternateFileName="NETWOR~1")) returned 1 [0204.645] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82330270, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82330270, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8262ad90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network Action Predictor-journal", cAlternateFileName="NETWOR~2")) returned 1 [0204.645] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86263d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86263d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86263d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network Persistent State", cAlternateFileName="NETWOR~3")) returned 1 [0204.645] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81d16a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81d16a10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x94034050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Origin Bound Certs", cAlternateFileName="ORIGIN~1")) returned 1 [0204.645] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81d16a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81d16a10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9405a1b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Origin Bound Certs-journal", cAlternateFileName="ORIGIN~2")) returned 1 [0204.645] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c43f3e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c446910, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Preferences", cAlternateFileName="PREFER~1")) returned 1 [0204.645] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f8dea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f8dea80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8129b860, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="previews_opt_out.db", cAlternateFileName="PREVIE~1.DB")) returned 1 [0204.645] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x804795c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x804795c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x812c19c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="previews_opt_out.db-journal", cAlternateFileName="PREVIE~1.DB-")) returned 1 [0204.645] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8687f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x869fc2d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuotaManager", cAlternateFileName="QUOTAM~1")) returned 1 [0204.645] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8687f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuotaManager-journal", cAlternateFileName="QUOTAM~2")) returned 1 [0204.665] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f846500, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f846500, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="README", cAlternateFileName="")) returned 1 [0204.665] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857e1690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c3f38f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c404a60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8b43, dwReserved0=0x0, dwReserved1=0x0, cFileName="Secure Preferences", cAlternateFileName="SECURE~1")) returned 1 [0204.665] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8218d350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8218d350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82271b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shortcuts", cAlternateFileName="SHORTC~1")) returned 1 [0204.665] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8218d350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8218d350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x822e3fb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shortcuts-journal", cAlternateFileName="SHORTC~2")) returned 1 [0204.665] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84251e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84251e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sync Extension Settings", cAlternateFileName="SYNCEX~1")) returned 1 [0204.665] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80d66840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80d66840, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8195e7b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Top Sites", cAlternateFileName="TOPSIT~1")) returned 1 [0204.665] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80d8c9a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80d8c9a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81984910, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Top Sites-journal", cAlternateFileName="TOPSIT~2")) returned 1 [0204.666] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x88c2e920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x88c2e920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x88c2e920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x278, dwReserved0=0x0, dwReserved1=0x0, cFileName="TransportSecurity", cAlternateFileName="TRANSP~1")) returned 1 [0204.666] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80ee3600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80ee3600, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8c6cde50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visited Links", cAlternateFileName="VISITE~1")) returned 1 [0204.666] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x868593b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x868593b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Applications", cAlternateFileName="WEBAPP~1")) returned 1 [0204.666] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f86c660, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f86c660, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82d370c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Data", cAlternateFileName="WEBDAT~1")) returned 1 [0204.666] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f86c660, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f86c660, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82d608d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Data-journal", cAlternateFileName="WEBDAT~2")) returned 1 [0204.666] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0204.666] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0204.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0204.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0204.667] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default", lpFilePart=0x0) returned 0x4b [0204.667] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist", lpFilePart=0x0) returned 0x4f [0204.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0204.667] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist", lpFilePart=0x0) returned 0x4f [0204.667] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\", lpFilePart=0x0) returned 0x50 [0204.667] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0204.668] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.668] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0204.668] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0204.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0204.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0204.668] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist", lpFilePart=0x0) returned 0x4f [0204.669] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies", lpFilePart=0x0) returned 0x54 [0204.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0204.669] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies", lpFilePart=0x0) returned 0x54 [0204.669] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\", lpFilePart=0x0) returned 0x55 [0204.669] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0204.669] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.669] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0204.669] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0204.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0204.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0204.670] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies", lpFilePart=0x0) returned 0x54 [0204.670] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials", lpFilePart=0x0) returned 0x50 [0204.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0204.670] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials", lpFilePart=0x0) returned 0x50 [0204.670] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\", lpFilePart=0x0) returned 0x51 [0204.670] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0204.670] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.670] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0204.670] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0204.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0204.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0204.671] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials", lpFilePart=0x0) returned 0x50 [0204.671] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash", lpFilePart=0x0) returned 0x4f [0204.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0204.671] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash", lpFilePart=0x0) returned 0x4f [0204.671] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\", lpFilePart=0x0) returned 0x50 [0204.671] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0204.671] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.672] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0204.672] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0204.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0204.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0204.672] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash", lpFilePart=0x0) returned 0x4f [0204.672] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl", lpFilePart=0x0) returned 0x49 [0204.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0204.672] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl", lpFilePart=0x0) returned 0x49 [0204.672] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\", lpFilePart=0x0) returned 0x4a [0204.672] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e47510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e47510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0204.672] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e47510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e47510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.673] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e47510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e47510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0204.673] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0204.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0204.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0204.673] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl", lpFilePart=0x0) returned 0x49 [0204.673] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant", lpFilePart=0x0) returned 0x55 [0204.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0204.673] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant", lpFilePart=0x0) returned 0x55 [0204.673] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\", lpFilePart=0x0) returned 0x56 [0204.673] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0204.674] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.674] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0204.674] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0204.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0204.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0204.675] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant", lpFilePart=0x0) returned 0x55 [0204.675] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter", lpFilePart=0x0) returned 0x4e [0204.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0204.675] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter", lpFilePart=0x0) returned 0x4e [0204.675] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\", lpFilePart=0x0) returned 0x4f [0204.675] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0204.675] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.676] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0204.676] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0204.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0204.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0204.676] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter", lpFilePart=0x0) returned 0x4e [0204.676] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm", lpFilePart=0x0) returned 0x4f [0204.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0204.676] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm", lpFilePart=0x0) returned 0x4f [0204.676] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\", lpFilePart=0x0) returned 0x50 [0204.676] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0204.677] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.677] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0204.677] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0204.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0204.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0204.677] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm", lpFilePart=0x0) returned 0x4f [0204.677] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports", lpFilePart=0x0) returned 0x3f [0204.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0204.677] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports", lpFilePart=0x0) returned 0x3f [0204.678] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\", lpFilePart=0x0) returned 0x40 [0204.678] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0204.678] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.678] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0204.678] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0204.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0204.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0204.678] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports", lpFilePart=0x0) returned 0x3f [0204.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0204.679] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports", lpFilePart=0x0) returned 0x3f [0204.679] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\", lpFilePart=0x0) returned 0x40 [0204.679] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0204.679] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.679] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0204.679] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0204.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0204.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0204.679] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History", nBufferLength=0x105, lpBuffer=0x6a6ea20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History", lpFilePart=0x0) returned 0x33 [0204.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eee8) returned 1 [0204.679] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History", nBufferLength=0x105, lpBuffer=0x6a6e9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History", lpFilePart=0x0) returned 0x33 [0204.680] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\", nBufferLength=0x105, lpBuffer=0x6a6e9c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\", lpFilePart=0x0) returned 0x34 [0204.680] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\*", lpFindFileData=0x6a6ec10 | out: lpFindFileData=0x6a6ec10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0204.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6eeac) returned 1 [0204.681] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft", nBufferLength=0x105, lpBuffer=0x6a6ea20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft", lpFilePart=0x0) returned 0x35 [0204.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eee8) returned 1 [0204.681] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft", nBufferLength=0x105, lpBuffer=0x6a6e9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft", lpFilePart=0x0) returned 0x35 [0204.681] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x6a6e9c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\", lpFilePart=0x0) returned 0x36 [0204.681] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\*", lpFindFileData=0x6a6ec10 | out: lpFindFileData=0x6a6ec10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0204.682] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.682] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1 [0204.682] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1 [0204.682] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Feeds", cAlternateFileName="")) returned 1 [0204.682] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Feeds Cache", cAlternateFileName="FEEDSC~1")) returned 1 [0204.683] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d1d6940, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORMS", cAlternateFileName="")) returned 1 [0204.683] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IME12", cAlternateFileName="")) returned 1 [0204.683] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMJP12", cAlternateFileName="")) returned 1 [0204.683] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMJP8_1", cAlternateFileName="")) returned 1 [0204.683] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMJP9_0", cAlternateFileName="")) returned 1 [0204.683] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0204.683] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1 [0204.684] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4bb72310, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb72310, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1 [0204.684] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8ae80e80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8ae80e80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook", cAlternateFileName="")) returned 1 [0204.684] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0204.684] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TaskSchedulerConfig", cAlternateFileName="TASKSC~1")) returned 1 [0204.684] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ef99320, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio", cAlternateFileName="")) returned 1 [0204.685] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0204.685] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c881c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~3")) returned 1 [0204.685] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media", cAlternateFileName="WINDOW~2")) returned 1 [0204.685] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 1 [0204.685] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 0 [0204.685] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0204.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6eea8) returned 1 [0204.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6eeb4) returned 1 [0204.686] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\.", nBufferLength=0x105, lpBuffer=0x6a6e9a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft", lpFilePart=0x0) returned 0x35 [0204.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee88) returned 1 [0204.686] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft", nBufferLength=0x105, lpBuffer=0x6a6e990, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft", lpFilePart=0x0) returned 0x35 [0204.686] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x6a6e964, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\", lpFilePart=0x0) returned 0x36 [0204.686] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\*", lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0204.686] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.687] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1 [0204.687] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1 [0204.687] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Feeds", cAlternateFileName="")) returned 1 [0204.687] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Feeds Cache", cAlternateFileName="FEEDSC~1")) returned 1 [0204.687] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d1d6940, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORMS", cAlternateFileName="")) returned 1 [0204.687] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IME12", cAlternateFileName="")) returned 1 [0204.687] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMJP12", cAlternateFileName="")) returned 1 [0204.687] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMJP8_1", cAlternateFileName="")) returned 1 [0204.688] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMJP9_0", cAlternateFileName="")) returned 1 [0204.688] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0204.688] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1 [0204.688] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4bb72310, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb72310, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1 [0204.688] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8ae80e80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8ae80e80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook", cAlternateFileName="")) returned 1 [0204.688] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0204.688] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TaskSchedulerConfig", cAlternateFileName="TASKSC~1")) returned 1 [0204.688] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ef99320, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio", cAlternateFileName="")) returned 1 [0204.689] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0204.689] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c881c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~3")) returned 1 [0204.689] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media", cAlternateFileName="WINDOW~2")) returned 1 [0204.689] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 1 [0204.689] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0204.689] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0204.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee48) returned 1 [0204.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee54) returned 1 [0204.689] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x41 [0204.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0204.690] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x41 [0204.690] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x42 [0204.690] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0204.690] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.690] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0204.690] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0204.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0204.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0204.690] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x41 [0204.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0204.690] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x41 [0204.690] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x42 [0204.691] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0204.691] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.691] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0204.691] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0204.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0204.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0204.691] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer", lpFilePart=0x0) returned 0x42 [0204.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0204.691] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer", lpFilePart=0x0) returned 0x42 [0204.691] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\", lpFilePart=0x0) returned 0x43 [0204.692] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0204.755] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.755] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0204.755] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0204.755] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0204.755] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0204.755] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer", lpFilePart=0x0) returned 0x42 [0204.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0204.755] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer", lpFilePart=0x0) returned 0x42 [0204.755] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\", lpFilePart=0x0) returned 0x43 [0204.755] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e43a0 [0204.756] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.756] FindNextFileW (in: hFindFile=0x9e43a0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0204.756] FindClose (in: hFindFile=0x9e43a0 | out: hFindFile=0x9e43a0) returned 1 [0204.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0204.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0204.756] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds", lpFilePart=0x0) returned 0x3b [0204.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0204.756] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds", lpFilePart=0x0) returned 0x3b [0204.756] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\", lpFilePart=0x0) returned 0x3c [0204.756] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e47a0 [0204.845] FindNextFileW (in: hFindFile=0x9e47a0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.846] FindNextFileW (in: hFindFile=0x9e47a0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x6e0227e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="FeedsStore.feedsdb-ms", cAlternateFileName="FEEDSS~1.FEE")) returned 1 [0204.846] FindNextFileW (in: hFindFile=0x9e47a0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Feeds~", cAlternateFileName="MICROS~1")) returned 1 [0204.846] FindNextFileW (in: hFindFile=0x9e47a0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", cAlternateFileName="{5588A~1")) returned 1 [0204.846] FindNextFileW (in: hFindFile=0x9e47a0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", cAlternateFileName="{5588A~1")) returned 0 [0204.846] FindClose (in: hFindFile=0x9e47a0 | out: hFindFile=0x9e47a0) returned 1 [0204.847] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0204.847] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0204.847] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds", lpFilePart=0x0) returned 0x3b [0204.847] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0204.847] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds", lpFilePart=0x0) returned 0x3b [0204.847] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\", lpFilePart=0x0) returned 0x3c [0204.847] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e47a0 [0204.848] FindNextFileW (in: hFindFile=0x9e47a0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.849] FindNextFileW (in: hFindFile=0x9e47a0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x6e0227e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="FeedsStore.feedsdb-ms", cAlternateFileName="FEEDSS~1.FEE")) returned 1 [0204.849] FindNextFileW (in: hFindFile=0x9e47a0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Feeds~", cAlternateFileName="MICROS~1")) returned 1 [0204.849] FindNextFileW (in: hFindFile=0x9e47a0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", cAlternateFileName="{5588A~1")) returned 1 [0204.849] FindNextFileW (in: hFindFile=0x9e47a0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0204.849] FindClose (in: hFindFile=0x9e47a0 | out: hFindFile=0x9e47a0) returned 1 [0204.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0204.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0204.850] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x6a6e92c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x4c [0204.851] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpFilePart=0x0) returned 0x4c [0204.851] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x6a6e92c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x4c [0204.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0204.853] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x6a6e8fc, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x4c [0204.853] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpFilePart=0x0) returned 0x4c [0204.853] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x6a6e8fc, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x4c [0204.854] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x6a6e8dc, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x4d [0204.855] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x6a6e8d0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x4d [0204.855] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpFilePart=0x0) returned 0x4d [0204.855] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x6a6e8d0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x4d [0204.857] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0204.894] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.894] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfeaa2466, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft at Home~.feed-ms", cAlternateFileName="MICROS~2.FEE")) returned 1 [0205.013] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft at Work~.feed-ms", cAlternateFileName="MICROS~1.FEE")) returned 1 [0205.025] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSNBC News~.feed-ms", cAlternateFileName="MSNBCN~1.FEE")) returned 1 [0205.026] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0205.026] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0205.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0205.027] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x6a6e8b4, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x4d [0205.027] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpFilePart=0x0) returned 0x4c [0205.028] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x6a6e8b4, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x4c [0205.028] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0205.028] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x6a6e89c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x4c [0205.029] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpFilePart=0x0) returned 0x4c [0205.029] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x6a6e89c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x4c [0205.029] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x6a6e87c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x4d [0205.030] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x6a6e870, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x4d [0205.031] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpFilePart=0x0) returned 0x4d [0205.031] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x6a6e870, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x4d [0205.032] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.032] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.033] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfeaa2466, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft at Home~.feed-ms", cAlternateFileName="MICROS~2.FEE")) returned 1 [0205.033] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft at Work~.feed-ms", cAlternateFileName="MICROS~1.FEE")) returned 1 [0205.033] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSNBC News~.feed-ms", cAlternateFileName="MSNBCN~1.FEE")) returned 1 [0205.033] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSNBC News~.feed-ms", cAlternateFileName="MSNBCN~1.FEE")) returned 0 [0205.033] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0205.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0205.033] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x6a6e92c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x63 [0205.034] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpFilePart=0x0) returned 0x63 [0205.034] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x6a6e92c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x63 [0205.035] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0205.035] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x6a6e8fc, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x63 [0205.036] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpFilePart=0x0) returned 0x63 [0205.036] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x6a6e8fc, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x63 [0205.036] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x6a6e8dc, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64 [0205.037] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x6a6e8d0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64 [0205.040] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpFilePart=0x0) returned 0x64 [0205.040] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x6a6e8d0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64 [0205.042] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.042] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.042] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d69eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d69eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebSlices~", cAlternateFileName="WEBSLI~1")) returned 1 [0205.042] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d69eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d69eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebSlices~", cAlternateFileName="WEBSLI~1")) returned 0 [0205.043] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0205.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0205.043] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x6a6e8b4, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64 [0205.044] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpFilePart=0x0) returned 0x63 [0205.044] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x6a6e8b4, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x63 [0205.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0205.044] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x6a6e89c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x63 [0205.050] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpFilePart=0x0) returned 0x63 [0205.050] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x6a6e89c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x63 [0205.051] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x6a6e87c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64 [0205.051] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x6a6e870, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64 [0205.052] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpFilePart=0x0) returned 0x64 [0205.052] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x6a6e870, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64 [0205.054] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.054] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.054] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d69eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d69eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebSlices~", cAlternateFileName="WEBSLI~1")) returned 1 [0205.054] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0205.054] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.054] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0205.054] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0205.054] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x6a6e8bc, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64 [0205.055] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x6a6e8bc, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x6e [0205.056] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpFilePart=0x0) returned 0x6e [0205.056] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x6a6e8bc, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x6e [0205.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0205.057] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x6a6e88c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64 [0205.058] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x6a6e88c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x6e [0205.058] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpFilePart=0x0) returned 0x6e [0205.058] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x6a6e88c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x6e [0205.059] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x6a6e86c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64 [0205.059] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x6a6e86c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x6f [0205.060] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x6a6e860, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64 [0205.060] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x6a6e860, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x6f [0205.061] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpFilePart=0x0) returned 0x6f [0205.061] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x6a6e860, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x6f [0205.063] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d69eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d69eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.063] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d69eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d69eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.063] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52d69eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52d69eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6e0227e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Suggested Sites~.feed-ms", cAlternateFileName="SUGGES~1.FEE")) returned 1 [0205.067] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Slice Gallery~.feed-ms", cAlternateFileName="WEBSLI~1.FEE")) returned 1 [0205.092] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0205.092] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0205.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0205.093] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x6a6e844, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64 [0205.094] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x6a6e844, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x6f [0205.094] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpFilePart=0x0) returned 0x6e [0205.094] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x6a6e844, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x6e [0205.095] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache", lpFilePart=0x0) returned 0x41 [0205.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0205.095] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache", lpFilePart=0x0) returned 0x41 [0205.095] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\", lpFilePart=0x0) returned 0x42 [0205.095] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.115] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.116] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1NBUR4HR", cAlternateFileName="")) returned 1 [0205.116] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6ASVN7J7", cAlternateFileName="")) returned 1 [0205.116] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="D68G7BIJ", cAlternateFileName="")) returned 1 [0205.116] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0205.116] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2bc126f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0205.116] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KQMHSVKD", cAlternateFileName="")) returned 1 [0205.116] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KQMHSVKD", cAlternateFileName="")) returned 0 [0205.117] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0205.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0205.117] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache", lpFilePart=0x0) returned 0x41 [0205.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0205.118] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache", lpFilePart=0x0) returned 0x41 [0205.118] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\", lpFilePart=0x0) returned 0x42 [0205.118] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.119] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.119] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1NBUR4HR", cAlternateFileName="")) returned 1 [0205.119] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6ASVN7J7", cAlternateFileName="")) returned 1 [0205.119] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="D68G7BIJ", cAlternateFileName="")) returned 1 [0205.119] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0205.119] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2bc126f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0205.119] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KQMHSVKD", cAlternateFileName="")) returned 1 [0205.120] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0205.120] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0205.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0205.121] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR", lpFilePart=0x0) returned 0x4a [0205.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0205.121] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR", lpFilePart=0x0) returned 0x4a [0205.121] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\", lpFilePart=0x0) returned 0x4b [0205.121] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.122] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.122] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0205.122] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0205.122] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0205.122] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.122] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0205.122] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0205.123] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR", lpFilePart=0x0) returned 0x4a [0205.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0205.123] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR", lpFilePart=0x0) returned 0x4a [0205.123] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\", lpFilePart=0x0) returned 0x4b [0205.123] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.123] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.123] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0205.123] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0205.124] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0 [0205.124] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0205.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0205.124] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7", lpFilePart=0x0) returned 0x4a [0205.124] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0205.124] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7", lpFilePart=0x0) returned 0x4a [0205.124] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\", lpFilePart=0x0) returned 0x4b [0205.124] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.124] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.125] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0205.125] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0205.125] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0205.125] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.125] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0205.125] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0205.125] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7", lpFilePart=0x0) returned 0x4a [0205.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0205.125] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7", lpFilePart=0x0) returned 0x4a [0205.125] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\", lpFilePart=0x0) returned 0x4b [0205.125] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.126] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.126] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0205.126] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0205.126] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0 [0205.126] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0205.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0205.126] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ", lpFilePart=0x0) returned 0x4a [0205.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0205.127] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ", lpFilePart=0x0) returned 0x4a [0205.127] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\", lpFilePart=0x0) returned 0x4b [0205.127] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.127] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.127] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0205.127] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0205.127] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0205.127] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0205.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0205.128] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ", lpFilePart=0x0) returned 0x4a [0205.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0205.128] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ", lpFilePart=0x0) returned 0x4a [0205.128] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\", lpFilePart=0x0) returned 0x4b [0205.128] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.128] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.128] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0205.128] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0205.129] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0 [0205.129] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0205.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0205.129] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD", lpFilePart=0x0) returned 0x4a [0205.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0205.129] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD", lpFilePart=0x0) returned 0x4a [0205.129] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\", lpFilePart=0x0) returned 0x4b [0205.129] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.129] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.130] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0205.130] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfed03a6b, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0205.130] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0x52d90010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ieonline.microsoft[1]", cAlternateFileName="IEONLI~1.MIC")) returned 1 [0205.130] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0205.130] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0205.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0205.130] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD", lpFilePart=0x0) returned 0x4a [0205.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0205.130] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD", lpFilePart=0x0) returned 0x4a [0205.130] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\", lpFilePart=0x0) returned 0x4b [0205.131] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.131] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.131] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0205.131] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfed03a6b, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0205.131] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0x52d90010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ieonline.microsoft[1]", cAlternateFileName="IEONLI~1.MIC")) returned 1 [0205.131] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0x52d90010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ieonline.microsoft[1]", cAlternateFileName="IEONLI~1.MIC")) returned 0 [0205.132] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0205.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0205.132] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS", lpFilePart=0x0) returned 0x3b [0205.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0205.132] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS", lpFilePart=0x0) returned 0x3b [0205.132] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\", lpFilePart=0x0) returned 0x3c [0205.132] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d1d6940, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.133] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d1d6940, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.133] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d757c20, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x3c0dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRMCACHE.DAT", cAlternateFileName="")) returned 1 [0205.133] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0205.133] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0205.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0205.134] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS", lpFilePart=0x0) returned 0x3b [0205.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0205.134] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS", lpFilePart=0x0) returned 0x3b [0205.134] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\", lpFilePart=0x0) returned 0x3c [0205.134] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d1d6940, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.134] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d1d6940, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.134] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d757c20, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x3c0dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRMCACHE.DAT", cAlternateFileName="")) returned 1 [0205.135] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d757c20, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x3c0dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRMCACHE.DAT", cAlternateFileName="")) returned 0 [0205.135] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0205.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0205.135] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12", lpFilePart=0x0) returned 0x3b [0205.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0205.135] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12", lpFilePart=0x0) returned 0x3b [0205.135] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\", lpFilePart=0x0) returned 0x3c [0205.135] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.135] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.136] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0205.136] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0205.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0205.136] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12", lpFilePart=0x0) returned 0x3b [0205.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0205.136] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12", lpFilePart=0x0) returned 0x3b [0205.136] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\", lpFilePart=0x0) returned 0x3c [0205.136] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.136] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.137] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0205.137] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0205.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0205.137] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12", lpFilePart=0x0) returned 0x3c [0205.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0205.137] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12", lpFilePart=0x0) returned 0x3c [0205.137] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\", lpFilePart=0x0) returned 0x3d [0205.137] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.138] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.138] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0205.138] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0205.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0205.138] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12", lpFilePart=0x0) returned 0x3c [0205.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0205.138] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12", lpFilePart=0x0) returned 0x3c [0205.139] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\", lpFilePart=0x0) returned 0x3d [0205.139] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.139] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.139] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0205.139] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0205.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0205.139] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1", lpFilePart=0x0) returned 0x3d [0205.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0205.139] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1", lpFilePart=0x0) returned 0x3d [0205.140] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\", lpFilePart=0x0) returned 0x3e [0205.140] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.140] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.141] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0205.141] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.141] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0205.141] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0205.141] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1", lpFilePart=0x0) returned 0x3d [0205.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0205.141] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1", lpFilePart=0x0) returned 0x3d [0205.141] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\", lpFilePart=0x0) returned 0x3e [0205.141] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.141] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.142] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0205.142] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0205.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0205.142] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0", lpFilePart=0x0) returned 0x3d [0205.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0205.142] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0", lpFilePart=0x0) returned 0x3d [0205.142] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\", lpFilePart=0x0) returned 0x3e [0205.142] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.142] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.143] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0205.143] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0205.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0205.143] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0", lpFilePart=0x0) returned 0x3d [0205.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0205.143] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0", lpFilePart=0x0) returned 0x3d [0205.143] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\", lpFilePart=0x0) returned 0x3e [0205.143] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.143] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.143] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0205.144] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.144] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0205.144] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0205.144] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x47 [0205.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0205.144] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x47 [0205.144] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\", lpFilePart=0x0) returned 0x48 [0205.144] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.146] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.146] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb371c2, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x2fa9, dwReserved0=0x0, dwReserved1=0x0, cFileName="brndlog.bak", cAlternateFileName="")) returned 1 [0205.146] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d977900, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2fb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="brndlog.txt", cAlternateFileName="")) returned 1 [0205.146] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DOMStore", cAlternateFileName="")) returned 1 [0205.147] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x65d58120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65d58120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65d58120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x23f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="frameiconcache.dat", cAlternateFileName="FRAMEI~1.DAT")) returned 1 [0205.147] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95014270, ftCreationTime.dwHighDateTime=0x1d2fab5, ftLastAccessTime.dwLowDateTime=0x95014270, ftLastAccessTime.dwHighDateTime=0x1d2fab5, ftLastWriteTime.dwLowDateTime=0x95014270, ftLastWriteTime.dwHighDateTime=0x1d2fab5, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSIMGSIZ.DAT", cAlternateFileName="")) returned 1 [0205.147] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6db5fbe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6db5fbe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0205.147] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6db5fbe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6db5fbe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 0 [0205.147] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.148] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0205.148] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0205.148] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x47 [0205.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0205.148] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x47 [0205.148] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\", lpFilePart=0x0) returned 0x48 [0205.148] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.149] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.149] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb371c2, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x2fa9, dwReserved0=0x0, dwReserved1=0x0, cFileName="brndlog.bak", cAlternateFileName="")) returned 1 [0205.149] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d977900, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2fb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="brndlog.txt", cAlternateFileName="")) returned 1 [0205.150] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DOMStore", cAlternateFileName="")) returned 1 [0205.150] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x65d58120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65d58120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65d58120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x23f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="frameiconcache.dat", cAlternateFileName="FRAMEI~1.DAT")) returned 1 [0205.150] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95014270, ftCreationTime.dwHighDateTime=0x1d2fab5, ftLastAccessTime.dwLowDateTime=0x95014270, ftLastAccessTime.dwHighDateTime=0x1d2fab5, ftLastWriteTime.dwLowDateTime=0x95014270, ftLastWriteTime.dwHighDateTime=0x1d2fab5, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSIMGSIZ.DAT", cAlternateFileName="")) returned 1 [0205.150] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6db5fbe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6db5fbe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0205.150] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0205.151] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0205.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0205.152] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore", lpFilePart=0x0) returned 0x50 [0205.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0205.152] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore", lpFilePart=0x0) returned 0x50 [0205.152] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\", lpFilePart=0x0) returned 0x51 [0205.152] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.154] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.154] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3LKBQZJ3", cAlternateFileName="")) returned 1 [0205.154] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8NES5H33", cAlternateFileName="")) returned 1 [0205.155] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FKLUIDU0", cAlternateFileName="")) returned 1 [0205.155] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x125db390, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0205.155] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWLVMZRC", cAlternateFileName="")) returned 1 [0205.155] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWLVMZRC", cAlternateFileName="")) returned 0 [0205.155] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0205.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0205.155] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore", lpFilePart=0x0) returned 0x50 [0205.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0205.156] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore", lpFilePart=0x0) returned 0x50 [0205.156] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\", lpFilePart=0x0) returned 0x51 [0205.156] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.156] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.156] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3LKBQZJ3", cAlternateFileName="")) returned 1 [0205.156] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8NES5H33", cAlternateFileName="")) returned 1 [0205.157] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FKLUIDU0", cAlternateFileName="")) returned 1 [0205.157] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x125db390, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0205.157] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWLVMZRC", cAlternateFileName="")) returned 1 [0205.157] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0205.157] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0205.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0205.157] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3", lpFilePart=0x0) returned 0x59 [0205.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0205.158] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3", lpFilePart=0x0) returned 0x59 [0205.158] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\", lpFilePart=0x0) returned 0x5a [0205.158] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.158] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.158] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0205.159] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0205.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0205.159] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3", lpFilePart=0x0) returned 0x59 [0205.159] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33", lpFilePart=0x0) returned 0x59 [0205.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0205.159] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33", lpFilePart=0x0) returned 0x59 [0205.159] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\", lpFilePart=0x0) returned 0x5a [0205.159] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.160] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.160] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d941010, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x0, cFileName="get.adobe[1].xml", cAlternateFileName="GETADO~1.XML")) returned 1 [0205.160] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0205.160] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0205.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0205.160] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33", lpFilePart=0x0) returned 0x59 [0205.160] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0", lpFilePart=0x0) returned 0x59 [0205.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0205.162] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0", lpFilePart=0x0) returned 0x59 [0205.162] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\", lpFilePart=0x0) returned 0x5a [0205.162] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.162] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.163] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0205.163] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0205.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0205.163] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0", lpFilePart=0x0) returned 0x59 [0205.163] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC", lpFilePart=0x0) returned 0x59 [0205.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0205.163] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC", lpFilePart=0x0) returned 0x59 [0205.163] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\", lpFilePart=0x0) returned 0x5a [0205.163] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.166] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.166] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0205.166] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0205.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0205.166] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC", lpFilePart=0x0) returned 0x59 [0205.167] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery", lpFilePart=0x0) returned 0x50 [0205.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0205.167] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery", lpFilePart=0x0) returned 0x50 [0205.167] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\", lpFilePart=0x0) returned 0x51 [0205.167] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6db5fbe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6db5fbe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.167] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6db5fbe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6db5fbe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.168] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed70f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bc84b10, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bc84b10, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Active", cAlternateFileName="")) returned 1 [0205.168] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6db5fbe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x30603250, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Last Active", cAlternateFileName="LASTAC~1")) returned 1 [0205.168] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6db5fbe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x30603250, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Last Active", cAlternateFileName="LASTAC~1")) returned 0 [0205.168] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.168] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0205.168] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0205.168] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery", lpFilePart=0x0) returned 0x50 [0205.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0205.169] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery", lpFilePart=0x0) returned 0x50 [0205.169] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\", lpFilePart=0x0) returned 0x51 [0205.169] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6db5fbe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6db5fbe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.169] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6db5fbe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6db5fbe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.169] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed70f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bc84b10, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bc84b10, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Active", cAlternateFileName="")) returned 1 [0205.169] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6db5fbe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x30603250, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Last Active", cAlternateFileName="LASTAC~1")) returned 1 [0205.170] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0205.170] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0205.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0205.170] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active", lpFilePart=0x0) returned 0x57 [0205.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0205.170] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active", lpFilePart=0x0) returned 0x57 [0205.170] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\", lpFilePart=0x0) returned 0x58 [0205.171] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed70f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bc84b10, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bc84b10, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.171] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed70f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bc84b10, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bc84b10, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.172] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed70f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bc84b10, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bc84b10, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0205.172] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0205.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0205.172] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active", lpFilePart=0x0) returned 0x57 [0205.172] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active", lpFilePart=0x0) returned 0x5c [0205.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0205.172] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active", lpFilePart=0x0) returned 0x5c [0205.172] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\", lpFilePart=0x0) returned 0x5d [0205.172] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6db5fbe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x30603250, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.174] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6db5fbe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x30603250, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.175] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe35acf0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe35acf0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x306293b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat", cAlternateFileName="RECOVE~2.DAT")) returned 1 [0205.175] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6dd28c60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6dd28c60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe35acf0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat", cAlternateFileName="RECOVE~1.DAT")) returned 1 [0205.175] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe35acf0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe35acf0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe35acf0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat", cAlternateFileName="{4BD65~1.DAT")) returned 1 [0205.175] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30603250, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x306293b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat", cAlternateFileName="{69512~1.DAT")) returned 1 [0205.175] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0205.175] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0205.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0205.176] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active", lpFilePart=0x0) returned 0x5c [0205.176] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player", lpFilePart=0x0) returned 0x42 [0205.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0205.176] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player", lpFilePart=0x0) returned 0x42 [0205.176] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\", lpFilePart=0x0) returned 0x43 [0205.176] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.178] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.178] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2cf59b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x105000, dwReserved0=0x0, dwReserved1=0x0, cFileName="CurrentDatabase_372.wmdb", cAlternateFileName="CURREN~1.WMD")) returned 1 [0205.178] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2cf33a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2cf33a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1106c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalMLS_3.wmdb", cAlternateFileName="LOCALM~1.WMD")) returned 1 [0205.178] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sync Playlists", cAlternateFileName="SYNCPL~1")) returned 1 [0205.179] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Transcoded Files Cache", cAlternateFileName="TRANSC~1")) returned 1 [0205.179] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Transcoded Files Cache", cAlternateFileName="TRANSC~1")) returned 0 [0205.179] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0205.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0205.180] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player", lpFilePart=0x0) returned 0x42 [0205.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0205.180] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player", lpFilePart=0x0) returned 0x42 [0205.180] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\", lpFilePart=0x0) returned 0x43 [0205.180] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.181] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.181] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2cf59b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x105000, dwReserved0=0x0, dwReserved1=0x0, cFileName="CurrentDatabase_372.wmdb", cAlternateFileName="CURREN~1.WMD")) returned 1 [0205.181] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2cf33a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2cf33a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1106c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalMLS_3.wmdb", cAlternateFileName="LOCALM~1.WMD")) returned 1 [0205.182] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sync Playlists", cAlternateFileName="SYNCPL~1")) returned 1 [0205.182] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Transcoded Files Cache", cAlternateFileName="TRANSC~1")) returned 1 [0205.182] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0205.182] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0205.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0205.183] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists", lpFilePart=0x0) returned 0x51 [0205.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0205.183] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists", lpFilePart=0x0) returned 0x51 [0205.183] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\", lpFilePart=0x0) returned 0x52 [0205.183] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.184] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.184] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0205.184] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0205.184] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0205.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0205.185] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists", lpFilePart=0x0) returned 0x51 [0205.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0205.185] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists", lpFilePart=0x0) returned 0x51 [0205.185] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\", lpFilePart=0x0) returned 0x52 [0205.185] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.185] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.185] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0205.185] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0205.186] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0205.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0205.186] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US", lpFilePart=0x0) returned 0x57 [0205.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0205.186] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US", lpFilePart=0x0) returned 0x57 [0205.186] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\", lpFilePart=0x0) returned 0x58 [0205.186] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.186] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.187] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0000E713", cAlternateFileName="")) returned 1 [0205.187] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="00010C6E", cAlternateFileName="")) returned 1 [0205.187] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="00010C6E", cAlternateFileName="")) returned 0 [0205.187] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0205.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0205.187] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US", lpFilePart=0x0) returned 0x57 [0205.187] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache", lpFilePart=0x0) returned 0x59 [0205.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0205.187] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache", lpFilePart=0x0) returned 0x59 [0205.187] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\", lpFilePart=0x0) returned 0x5a [0205.187] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.188] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.188] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0205.189] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0205.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0205.189] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache", lpFilePart=0x0) returned 0x59 [0205.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0205.189] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache", lpFilePart=0x0) returned 0x59 [0205.189] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\", lpFilePart=0x0) returned 0x5a [0205.189] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.189] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.190] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0205.190] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0205.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0205.190] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office", lpFilePart=0x0) returned 0x3c [0205.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0205.190] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office", lpFilePart=0x0) returned 0x3c [0205.190] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\", lpFilePart=0x0) returned 0x3d [0205.190] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4bb72310, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb72310, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.191] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4bb72310, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb72310, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.191] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf7a855a0, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7a855a0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14.0", cAlternateFileName="")) returned 1 [0205.192] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Groove", cAlternateFileName="")) returned 1 [0205.192] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONetConfig", cAlternateFileName="ONETCO~1")) returned 1 [0205.192] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONetConfig", cAlternateFileName="ONETCO~1")) returned 0 [0205.192] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0205.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0205.192] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office", lpFilePart=0x0) returned 0x3c [0205.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0205.192] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office", lpFilePart=0x0) returned 0x3c [0205.192] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\", lpFilePart=0x0) returned 0x3d [0205.192] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4bb72310, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb72310, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.193] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4bb72310, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb72310, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.193] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf7a855a0, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7a855a0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14.0", cAlternateFileName="")) returned 1 [0205.193] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Groove", cAlternateFileName="")) returned 1 [0205.193] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONetConfig", cAlternateFileName="ONETCO~1")) returned 1 [0205.193] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0205.193] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0205.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0205.193] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0", lpFilePart=0x0) returned 0x41 [0205.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0205.194] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0", lpFilePart=0x0) returned 0x41 [0205.194] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\", lpFilePart=0x0) returned 0x42 [0205.194] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf7a855a0, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7a855a0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.195] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf7a855a0, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7a855a0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.195] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeFileCache", cAlternateFileName="OFFICE~1")) returned 1 [0205.195] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeFileCache", cAlternateFileName="OFFICE~1")) returned 0 [0205.195] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0205.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0205.195] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0", lpFilePart=0x0) returned 0x41 [0205.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0205.195] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0", lpFilePart=0x0) returned 0x41 [0205.195] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\", lpFilePart=0x0) returned 0x42 [0205.195] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf7a855a0, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7a855a0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.196] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf7a855a0, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7a855a0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.196] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeFileCache", cAlternateFileName="OFFICE~1")) returned 1 [0205.196] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0205.196] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0205.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0205.196] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache", lpFilePart=0x0) returned 0x51 [0205.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0205.196] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache", lpFilePart=0x0) returned 0x51 [0205.196] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\", lpFilePart=0x0) returned 0x52 [0205.196] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.198] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.198] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7aab700, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7aab700, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="FSD-CNRY.FSD", cAlternateFileName="")) returned 1 [0205.198] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7ad1860, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7af79c0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD", cAlternateFileName="FSD-{4~1.FSD")) returned 1 [0205.198] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7ad1860, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7af79c0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="FSF-CTBL.FSF", cAlternateFileName="")) returned 1 [0205.198] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0205.198] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0205.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0205.199] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache", lpFilePart=0x0) returned 0x51 [0205.199] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove", lpFilePart=0x0) returned 0x43 [0205.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0205.199] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove", lpFilePart=0x0) returned 0x43 [0205.199] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\", lpFilePart=0x0) returned 0x44 [0205.199] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.199] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.200] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0205.200] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User", cAlternateFileName="")) returned 1 [0205.200] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User", cAlternateFileName="")) returned 0 [0205.200] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0205.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0205.200] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove", lpFilePart=0x0) returned 0x43 [0205.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0205.200] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove", lpFilePart=0x0) returned 0x43 [0205.200] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\", lpFilePart=0x0) returned 0x44 [0205.200] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.201] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.201] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0205.201] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User", cAlternateFileName="")) returned 1 [0205.201] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0205.201] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.201] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0205.201] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0205.201] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System", lpFilePart=0x0) returned 0x4a [0205.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0205.202] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System", lpFilePart=0x0) returned 0x4a [0205.202] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\", lpFilePart=0x0) returned 0x4b [0205.202] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.202] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.202] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0205.203] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0205.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0205.203] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System", lpFilePart=0x0) returned 0x4a [0205.203] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User", lpFilePart=0x0) returned 0x48 [0205.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0205.203] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User", lpFilePart=0x0) returned 0x48 [0205.203] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\", lpFilePart=0x0) returned 0x49 [0205.203] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.204] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.204] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0205.204] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0205.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0205.204] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User", lpFilePart=0x0) returned 0x48 [0205.204] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig", lpFilePart=0x0) returned 0x47 [0205.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0205.204] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig", lpFilePart=0x0) returned 0x47 [0205.204] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\", lpFilePart=0x0) returned 0x48 [0205.205] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.205] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.206] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bd15230, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x80, dwReserved0=0x0, dwReserved1=0x0, cFileName="350db95df4cbd94b2a1c300510e12e11.sig", cAlternateFileName="350DB9~1.SIG")) returned 1 [0205.206] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bd15230, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x7ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="350db95df4cbd94b2a1c300510e12e11.xml", cAlternateFileName="350DB9~1.XML")) returned 1 [0205.206] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0205.206] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0205.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0205.206] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig", lpFilePart=0x0) returned 0x47 [0205.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0205.206] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig", lpFilePart=0x0) returned 0x47 [0205.206] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\", lpFilePart=0x0) returned 0x48 [0205.206] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.207] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.207] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bd15230, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x80, dwReserved0=0x0, dwReserved1=0x0, cFileName="350db95df4cbd94b2a1c300510e12e11.sig", cAlternateFileName="350DB9~1.SIG")) returned 1 [0205.207] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bd15230, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x7ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="350db95df4cbd94b2a1c300510e12e11.xml", cAlternateFileName="350DB9~1.XML")) returned 1 [0205.207] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bd15230, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x7ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="350db95df4cbd94b2a1c300510e12e11.xml", cAlternateFileName="350DB9~1.XML")) returned 0 [0205.207] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0205.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0205.207] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook", lpFilePart=0x0) returned 0x3d [0205.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0205.208] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook", lpFilePart=0x0) returned 0x3d [0205.208] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\", lpFilePart=0x0) returned 0x3e [0205.208] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8ae80e80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8ae80e80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.210] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8ae80e80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8ae80e80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.211] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3dc8cc40, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3dc8cc40, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3dc8cc40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x0, dwReserved1=0x0, cFileName="mapisvc.inf", cAlternateFileName="")) returned 1 [0205.211] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5c4d2d00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8ae80e80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8ae80e80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook.sharing.xml.obi", cAlternateFileName="OUTLOO~1.OBI")) returned 1 [0205.211] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RoamCache", cAlternateFileName="ROAMCA~1")) returned 1 [0205.211] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8ae80e80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x8ae80e80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x5c4d2d00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="~last~.sharing.xml.obi", cAlternateFileName="~LAST~~1.OBI")) returned 1 [0205.212] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0205.212] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0205.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0205.212] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook", lpFilePart=0x0) returned 0x3d [0205.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0205.212] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook", lpFilePart=0x0) returned 0x3d [0205.212] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\", lpFilePart=0x0) returned 0x3e [0205.213] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8ae80e80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8ae80e80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.213] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8ae80e80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8ae80e80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.213] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3dc8cc40, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3dc8cc40, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3dc8cc40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x0, dwReserved1=0x0, cFileName="mapisvc.inf", cAlternateFileName="")) returned 1 [0205.213] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5c4d2d00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8ae80e80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8ae80e80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook.sharing.xml.obi", cAlternateFileName="OUTLOO~1.OBI")) returned 1 [0205.213] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RoamCache", cAlternateFileName="ROAMCA~1")) returned 1 [0205.213] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8ae80e80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x8ae80e80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x5c4d2d00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="~last~.sharing.xml.obi", cAlternateFileName="~LAST~~1.OBI")) returned 1 [0205.214] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8ae80e80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x8ae80e80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x5c4d2d00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="~last~.sharing.xml.obi", cAlternateFileName="~LAST~~1.OBI")) returned 0 [0205.214] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0205.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0205.214] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache", lpFilePart=0x0) returned 0x47 [0205.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0205.214] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache", lpFilePart=0x0) returned 0x47 [0205.214] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\", lpFilePart=0x0) returned 0x48 [0205.214] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.215] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.215] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x60a26dc0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0205.216] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0205.216] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0205.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0205.216] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache", lpFilePart=0x0) returned 0x47 [0205.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0205.216] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache", lpFilePart=0x0) returned 0x47 [0205.216] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\", lpFilePart=0x0) returned 0x48 [0205.216] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.216] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.217] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x60a26dc0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0205.217] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x60a26dc0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0205.217] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0205.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0205.217] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher", lpFilePart=0x0) returned 0x3f [0205.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0205.217] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher", lpFilePart=0x0) returned 0x3f [0205.217] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\", lpFilePart=0x0) returned 0x40 [0205.217] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.219] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.219] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0205.219] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0205.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0205.220] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher", lpFilePart=0x0) returned 0x3f [0205.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0205.220] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher", lpFilePart=0x0) returned 0x3f [0205.220] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\", lpFilePart=0x0) returned 0x40 [0205.220] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.220] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.220] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0205.220] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0205.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0205.220] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig", lpFilePart=0x0) returned 0x49 [0205.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0205.221] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig", lpFilePart=0x0) returned 0x49 [0205.221] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\", lpFilePart=0x0) returned 0x4a [0205.221] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.254] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.254] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0205.254] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0205.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0205.254] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig", lpFilePart=0x0) returned 0x49 [0205.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0205.254] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig", lpFilePart=0x0) returned 0x49 [0205.254] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\", lpFilePart=0x0) returned 0x4a [0205.255] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.255] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.255] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0205.255] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0205.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0205.255] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio", lpFilePart=0x0) returned 0x3b [0205.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0205.255] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio", lpFilePart=0x0) returned 0x3b [0205.255] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\", lpFilePart=0x0) returned 0x3c [0205.255] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ef99320, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.256] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ef99320, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.256] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5ef99320, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5efe55e0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x18ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="content14.dat", cAlternateFileName="CONTEN~1.DAT")) returned 1 [0205.256] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x976e3d80, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x976e3d80, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x5f055ac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1f400, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbs.dat", cAlternateFileName="")) returned 1 [0205.256] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0205.256] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0205.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0205.256] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio", lpFilePart=0x0) returned 0x3b [0205.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0205.257] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio", lpFilePart=0x0) returned 0x3b [0205.257] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\", lpFilePart=0x0) returned 0x3c [0205.257] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ef99320, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.257] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ef99320, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.257] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5ef99320, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5efe55e0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x18ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="content14.dat", cAlternateFileName="CONTEN~1.DAT")) returned 1 [0205.258] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x976e3d80, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x976e3d80, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x5f055ac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1f400, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbs.dat", cAlternateFileName="")) returned 1 [0205.258] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x976e3d80, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x976e3d80, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x5f055ac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1f400, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbs.dat", cAlternateFileName="")) returned 0 [0205.258] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0205.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0205.258] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows", lpFilePart=0x0) returned 0x3d [0205.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0205.258] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows", lpFilePart=0x0) returned 0x3d [0205.258] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\", lpFilePart=0x0) returned 0x3e [0205.258] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.258] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.259] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1024", cAlternateFileName="")) returned 1 [0205.259] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34d50a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x34ef3970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0205.259] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x926116d0, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x926116d0, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Burn", cAlternateFileName="")) returned 1 [0205.259] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8deb4c00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8deb4c00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Caches", cAlternateFileName="")) returned 1 [0205.259] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Explorer", cAlternateFileName="")) returned 1 [0205.259] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameExplorer", cAlternateFileName="GAMEEX~1")) returned 1 [0205.260] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0205.260] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtones", cAlternateFileName="RINGTO~1")) returned 1 [0205.260] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe7138400, ftLastAccessTime.dwHighDateTime=0x1d2e625, ftLastWriteTime.dwLowDateTime=0xe7138400, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0205.260] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 1 [0205.260] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8f3fc040, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8f3fc040, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsrClass.dat", cAlternateFileName="")) returned 1 [0205.260] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x8f3d5ee0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsrClass.dat.LOG1", cAlternateFileName="USRCLA~2.LOG")) returned 1 [0205.260] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9c5705f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsrClass.dat.LOG2", cAlternateFileName="USRCLA~1.LOG")) returned 1 [0205.261] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x962222ec, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf", cAlternateFileName="USRCLA~1.BLF")) returned 1 [0205.261] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="USRCLA~2.REG")) returned 1 [0205.261] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="USRCLA~1.REG")) returned 1 [0205.261] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WER", cAlternateFileName="")) returned 1 [0205.261] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa734ff0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa734ff0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xa734ff0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsUpdate.log", cAlternateFileName="WINDOW~1.LOG")) returned 1 [0205.261] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0205.261] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0205.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0205.262] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows", lpFilePart=0x0) returned 0x3d [0205.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0205.262] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows", lpFilePart=0x0) returned 0x3d [0205.262] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\", lpFilePart=0x0) returned 0x3e [0205.262] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.262] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.262] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1024", cAlternateFileName="")) returned 1 [0205.262] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34d50a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x34ef3970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0205.262] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x926116d0, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x926116d0, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Burn", cAlternateFileName="")) returned 1 [0205.262] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8deb4c00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8deb4c00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Caches", cAlternateFileName="")) returned 1 [0205.263] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Explorer", cAlternateFileName="")) returned 1 [0205.263] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameExplorer", cAlternateFileName="GAMEEX~1")) returned 1 [0205.263] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0205.263] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtones", cAlternateFileName="RINGTO~1")) returned 1 [0205.263] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe7138400, ftLastAccessTime.dwHighDateTime=0x1d2e625, ftLastWriteTime.dwLowDateTime=0xe7138400, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0205.264] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 1 [0205.264] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8f3fc040, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8f3fc040, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsrClass.dat", cAlternateFileName="")) returned 1 [0205.264] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x8f3d5ee0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsrClass.dat.LOG1", cAlternateFileName="USRCLA~2.LOG")) returned 1 [0205.264] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9c5705f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsrClass.dat.LOG2", cAlternateFileName="USRCLA~1.LOG")) returned 1 [0205.264] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x962222ec, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf", cAlternateFileName="USRCLA~1.BLF")) returned 1 [0205.265] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="USRCLA~2.REG")) returned 1 [0205.265] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="USRCLA~1.REG")) returned 1 [0205.265] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WER", cAlternateFileName="")) returned 1 [0205.265] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa734ff0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa734ff0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xa734ff0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsUpdate.log", cAlternateFileName="WINDOW~1.LOG")) returned 1 [0205.265] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa734ff0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa734ff0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xa734ff0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsUpdate.log", cAlternateFileName="WINDOW~1.LOG")) returned 0 [0205.265] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0205.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0205.266] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1024", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1024", lpFilePart=0x0) returned 0x42 [0205.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0205.266] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1024", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1024", lpFilePart=0x0) returned 0x42 [0205.266] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1024\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1024\\", lpFilePart=0x0) returned 0x43 [0205.266] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1024\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.280] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.281] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0205.281] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0205.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0205.281] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1024\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1024", lpFilePart=0x0) returned 0x42 [0205.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0205.281] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1024", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1024", lpFilePart=0x0) returned 0x42 [0205.281] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1024\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1024\\", lpFilePart=0x0) returned 0x43 [0205.281] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1024\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.281] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.282] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0205.282] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0205.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0205.282] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033", lpFilePart=0x0) returned 0x42 [0205.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0205.282] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033", lpFilePart=0x0) returned 0x42 [0205.282] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\", lpFilePart=0x0) returned 0x43 [0205.282] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34d50a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x34ef3970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.289] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34d50a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x34ef3970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.290] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ef3970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8ecd4180, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x49098, dwReserved0=0x0, dwReserved1=0x0, cFileName="StructuredQuerySchema.bin", cAlternateFileName="STRUCT~1.BIN")) returned 1 [0205.290] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0205.290] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0205.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0205.290] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033", lpFilePart=0x0) returned 0x42 [0205.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0205.291] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033", lpFilePart=0x0) returned 0x42 [0205.291] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\", lpFilePart=0x0) returned 0x43 [0205.291] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34d50a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x34ef3970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.291] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34d50a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x34ef3970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.292] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ef3970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8ecd4180, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x49098, dwReserved0=0x0, dwReserved1=0x0, cFileName="StructuredQuerySchema.bin", cAlternateFileName="STRUCT~1.BIN")) returned 1 [0205.292] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ef3970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8ecd4180, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x49098, dwReserved0=0x0, dwReserved1=0x0, cFileName="StructuredQuerySchema.bin", cAlternateFileName="STRUCT~1.BIN")) returned 0 [0205.292] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0205.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0205.292] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn", lpFilePart=0x0) returned 0x42 [0205.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0205.292] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn", lpFilePart=0x0) returned 0x42 [0205.292] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\", lpFilePart=0x0) returned 0x43 [0205.292] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x926116d0, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x926116d0, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.293] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x926116d0, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x926116d0, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.293] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Burn", cAlternateFileName="")) returned 1 [0205.293] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3b9ee2a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f30c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Burn1", cAlternateFileName="")) returned 1 [0205.294] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x926116d0, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Burn2", cAlternateFileName="")) returned 1 [0205.294] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x926116d0, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Burn2", cAlternateFileName="")) returned 0 [0205.294] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0205.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0205.294] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn", lpFilePart=0x0) returned 0x42 [0205.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0205.294] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn", lpFilePart=0x0) returned 0x42 [0205.294] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\", lpFilePart=0x0) returned 0x43 [0205.294] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x926116d0, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x926116d0, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.294] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x926116d0, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x926116d0, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.295] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Burn", cAlternateFileName="")) returned 1 [0205.295] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3b9ee2a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f30c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Burn1", cAlternateFileName="")) returned 1 [0205.295] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x926116d0, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Burn2", cAlternateFileName="")) returned 1 [0205.295] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0205.295] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0205.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0205.295] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn", lpFilePart=0x0) returned 0x47 [0205.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0205.296] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn", lpFilePart=0x0) returned 0x47 [0205.296] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\", lpFilePart=0x0) returned 0x48 [0205.296] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.296] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.296] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0205.296] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0205.296] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0205.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0205.296] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn", lpFilePart=0x0) returned 0x47 [0205.297] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1", lpFilePart=0x0) returned 0x48 [0205.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0205.297] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1", lpFilePart=0x0) returned 0x48 [0205.297] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\", lpFilePart=0x0) returned 0x49 [0205.298] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3b9ee2a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f30c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.298] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3b9ee2a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f30c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.298] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3b9f09b0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f09b0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0205.298] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0205.298] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0205.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0205.298] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1", lpFilePart=0x0) returned 0x48 [0205.298] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2", lpFilePart=0x0) returned 0x48 [0205.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0205.298] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2", lpFilePart=0x0) returned 0x48 [0205.299] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\", lpFilePart=0x0) returned 0x49 [0205.299] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x926116d0, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.300] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x926116d0, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.300] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x92637830, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0205.300] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0205.300] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0205.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0205.301] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2", lpFilePart=0x0) returned 0x48 [0205.301] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches", lpFilePart=0x0) returned 0x44 [0205.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0205.301] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches", lpFilePart=0x0) returned 0x44 [0205.301] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\", lpFilePart=0x0) returned 0x45 [0205.301] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8deb4c00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8deb4c00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.301] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8deb4c00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8deb4c00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.301] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa1c6ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaa1c6ab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaa1c6ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="cversions.1.db", cAlternateFileName="CVERSI~1.DB")) returned 1 [0205.301] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13d2f3e0, ftCreationTime.dwHighDateTime=0x1d3b051, ftLastAccessTime.dwLowDateTime=0x13d2f3e0, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d2f3e0, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x1ea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db", cAlternateFileName="{AFBF9~1.DB")) returned 1 [0205.302] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8deb4c00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x8deb4c00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8deb4c00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1da50, dwReserved0=0x0, dwReserved1=0x0, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db", cAlternateFileName="{AFBF9~2.DB")) returned 1 [0205.302] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0205.302] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0205.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0205.302] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches", lpFilePart=0x0) returned 0x44 [0205.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0205.302] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches", lpFilePart=0x0) returned 0x44 [0205.302] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\", lpFilePart=0x0) returned 0x45 [0205.303] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8deb4c00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8deb4c00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.303] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8deb4c00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8deb4c00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.303] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa1c6ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaa1c6ab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaa1c6ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="cversions.1.db", cAlternateFileName="CVERSI~1.DB")) returned 1 [0205.303] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13d2f3e0, ftCreationTime.dwHighDateTime=0x1d3b051, ftLastAccessTime.dwLowDateTime=0x13d2f3e0, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d2f3e0, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x1ea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db", cAlternateFileName="{AFBF9~1.DB")) returned 1 [0205.303] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8deb4c00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x8deb4c00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8deb4c00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1da50, dwReserved0=0x0, dwReserved1=0x0, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db", cAlternateFileName="{AFBF9~2.DB")) returned 1 [0205.303] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8deb4c00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x8deb4c00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8deb4c00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1da50, dwReserved0=0x0, dwReserved1=0x0, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db", cAlternateFileName="{AFBF9~2.DB")) returned 0 [0205.304] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0205.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0205.304] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer", lpFilePart=0x0) returned 0x46 [0205.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0205.304] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer", lpFilePart=0x0) returned 0x46 [0205.304] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\", lpFilePart=0x0) returned 0x47 [0205.304] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.304] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.304] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x30db3250, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExplorerStartupLog.etl", cAlternateFileName="EXPLOR~2.ETL")) returned 1 [0205.304] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x312d3a40, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExplorerStartupLog_RunOnce.etl", cAlternateFileName="EXPLOR~1.ETL")) returned 1 [0205.305] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbcache_1024.db", cAlternateFileName="TH78CB~1.DB")) returned 1 [0205.305] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbcache_256.db", cAlternateFileName="THUMBC~4.DB")) returned 1 [0205.305] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ad1360, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33ad1360, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33ad1360, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbcache_32.db", cAlternateFileName="THUMBC~2.DB")) returned 1 [0205.305] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ad1360, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33ad1360, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33ad1360, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbcache_96.db", cAlternateFileName="THUMBC~3.DB")) returned 1 [0205.305] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ad1360, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33ad1360, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33ad1360, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0xcb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbcache_idx.db", cAlternateFileName="THUMBC~1.DB")) returned 1 [0205.305] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbcache_sr.db", cAlternateFileName="TH0F82~1.DB")) returned 1 [0205.306] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0205.306] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0205.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0205.306] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer", lpFilePart=0x0) returned 0x46 [0205.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0205.306] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer", lpFilePart=0x0) returned 0x46 [0205.306] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\", lpFilePart=0x0) returned 0x47 [0205.306] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.306] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.306] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x30db3250, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExplorerStartupLog.etl", cAlternateFileName="EXPLOR~2.ETL")) returned 1 [0205.307] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x312d3a40, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExplorerStartupLog_RunOnce.etl", cAlternateFileName="EXPLOR~1.ETL")) returned 1 [0205.307] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbcache_1024.db", cAlternateFileName="TH78CB~1.DB")) returned 1 [0205.307] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbcache_256.db", cAlternateFileName="THUMBC~4.DB")) returned 1 [0205.307] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ad1360, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33ad1360, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33ad1360, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbcache_32.db", cAlternateFileName="THUMBC~2.DB")) returned 1 [0205.307] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ad1360, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33ad1360, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33ad1360, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbcache_96.db", cAlternateFileName="THUMBC~3.DB")) returned 1 [0205.308] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ad1360, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33ad1360, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33ad1360, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0xcb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbcache_idx.db", cAlternateFileName="THUMBC~1.DB")) returned 1 [0205.308] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbcache_sr.db", cAlternateFileName="TH0F82~1.DB")) returned 1 [0205.308] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbcache_sr.db", cAlternateFileName="TH0F82~1.DB")) returned 0 [0205.308] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0205.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0205.308] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\GameExplorer", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\GameExplorer", lpFilePart=0x0) returned 0x4a [0205.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0205.308] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\GameExplorer", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\GameExplorer", lpFilePart=0x0) returned 0x4a [0205.308] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\", lpFilePart=0x0) returned 0x4b [0205.309] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.309] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.309] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0205.309] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0205.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0205.309] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\GameExplorer", lpFilePart=0x0) returned 0x4a [0205.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0205.309] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\GameExplorer", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\GameExplorer", lpFilePart=0x0) returned 0x4a [0205.310] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\", lpFilePart=0x0) returned 0x4b [0205.310] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.310] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.310] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0205.310] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.314] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0205.314] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0205.314] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History", lpFilePart=0x0) returned 0x45 [0205.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0205.314] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History", lpFilePart=0x0) returned 0x45 [0205.314] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\", lpFilePart=0x0) returned 0x46 [0205.314] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.405] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.405] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0205.405] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xde716ec0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde716ec0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1 [0205.405] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1 [0205.406] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 0 [0205.406] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0205.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0205.406] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History", lpFilePart=0x0) returned 0x45 [0205.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0205.406] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History", lpFilePart=0x0) returned 0x45 [0205.406] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\", lpFilePart=0x0) returned 0x46 [0205.406] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.407] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.407] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0205.407] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xde716ec0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde716ec0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1 [0205.407] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1 [0205.407] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0205.407] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0205.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0205.407] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5", lpFilePart=0x0) returned 0x51 [0205.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0205.407] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5", lpFilePart=0x0) returned 0x51 [0205.408] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\", lpFilePart=0x0) returned 0x52 [0205.408] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xde716ec0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde716ec0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.410] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xde716ec0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde716ec0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.410] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0205.410] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb1912e90, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0205.410] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xde716ec0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde716ec0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde716ec0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSHist012020022120200222", cAlternateFileName="MSHIST~1")) returned 1 [0205.411] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xde716ec0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xde716ec0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xde716ec0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSHist012020022120200222", cAlternateFileName="MSHIST~1")) returned 0 [0205.411] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0205.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0205.412] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5", lpFilePart=0x0) returned 0x51 [0205.412] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low", lpFilePart=0x0) returned 0x49 [0205.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0205.412] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low", lpFilePart=0x0) returned 0x49 [0205.412] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\", lpFilePart=0x0) returned 0x4a [0205.412] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.413] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.413] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0205.413] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1 [0205.413] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 0 [0205.413] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0205.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0205.414] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low", lpFilePart=0x0) returned 0x49 [0205.414] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Ringtones", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Ringtones", lpFilePart=0x0) returned 0x47 [0205.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0205.414] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Ringtones", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Ringtones", lpFilePart=0x0) returned 0x47 [0205.414] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\", lpFilePart=0x0) returned 0x48 [0205.414] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.414] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.414] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0205.415] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0205.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0205.415] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Ringtones", lpFilePart=0x0) returned 0x47 [0205.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0205.415] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Ringtones", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Ringtones", lpFilePart=0x0) returned 0x47 [0205.415] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\", lpFilePart=0x0) returned 0x48 [0205.415] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.415] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.415] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0205.415] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0205.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0205.416] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files", lpFilePart=0x0) returned 0x56 [0205.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0205.416] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files", lpFilePart=0x0) returned 0x56 [0205.416] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\", lpFilePart=0x0) returned 0x57 [0205.416] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe7138400, ftLastAccessTime.dwHighDateTime=0x1d2e625, ftLastWriteTime.dwLowDateTime=0xe7138400, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.418] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe7138400, ftLastAccessTime.dwHighDateTime=0x1d2e625, ftLastWriteTime.dwLowDateTime=0xe7138400, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.418] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 1 [0205.418] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.MSO", cAlternateFileName="")) returned 1 [0205.418] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27b4c650, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.Word", cAlternateFileName="CONTEN~1.WOR")) returned 1 [0205.419] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe710360, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0205.419] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1 [0205.419] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 1 [0205.419] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 0 [0205.419] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0205.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0205.420] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files", lpFilePart=0x0) returned 0x56 [0205.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0205.420] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files", lpFilePart=0x0) returned 0x56 [0205.420] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\", lpFilePart=0x0) returned 0x57 [0205.420] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe7138400, ftLastAccessTime.dwHighDateTime=0x1d2e625, ftLastWriteTime.dwLowDateTime=0xe7138400, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.421] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe7138400, ftLastAccessTime.dwHighDateTime=0x1d2e625, ftLastWriteTime.dwLowDateTime=0xe7138400, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.421] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 1 [0205.421] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.MSO", cAlternateFileName="")) returned 1 [0205.422] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27b4c650, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.Word", cAlternateFileName="CONTEN~1.WOR")) returned 1 [0205.422] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe710360, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0205.422] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1 [0205.422] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 1 [0205.422] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0205.422] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0205.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0205.423] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5", lpFilePart=0x0) returned 0x62 [0205.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0205.423] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5", lpFilePart=0x0) returned 0x62 [0205.423] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\", lpFilePart=0x0) returned 0x63 [0205.423] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.427] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.428] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e570c75, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0205.428] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xdfa216f0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0205.428] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MM5O9XQS", cAlternateFileName="")) returned 1 [0205.428] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PMMR5K9K", cAlternateFileName="")) returned 1 [0205.428] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIJUQL1C", cAlternateFileName="")) returned 1 [0205.428] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="X9OHK109", cAlternateFileName="")) returned 1 [0205.428] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="X9OHK109", cAlternateFileName="")) returned 0 [0205.428] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0205.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0205.429] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5", lpFilePart=0x0) returned 0x62 [0205.429] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO", lpFilePart=0x0) returned 0x62 [0205.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0205.429] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO", lpFilePart=0x0) returned 0x62 [0205.429] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\", lpFilePart=0x0) returned 0x63 [0205.429] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.432] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.432] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0205.432] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0205.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0205.432] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO", lpFilePart=0x0) returned 0x62 [0205.432] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word", lpFilePart=0x0) returned 0x63 [0205.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0205.432] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word", lpFilePart=0x0) returned 0x63 [0205.432] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\", lpFilePart=0x0) returned 0x64 [0205.503] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x32c0a7d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.503] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x32c0a7d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.504] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x32c0a7d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0205.504] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0205.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0205.504] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word", lpFilePart=0x0) returned 0x63 [0205.504] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low", lpFilePart=0x0) returned 0x5a [0205.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0205.504] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low", lpFilePart=0x0) returned 0x5a [0205.504] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\", lpFilePart=0x0) returned 0x5b [0205.504] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.505] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.505] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AntiPhishing", cAlternateFileName="ANTIPH~1")) returned 1 [0205.505] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 1 [0205.505] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0205.505] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51445650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSIMGSIZ.DAT", cAlternateFileName="")) returned 1 [0205.505] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0205.505] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0205.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0205.506] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low", lpFilePart=0x0) returned 0x5a [0205.506] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized", lpFilePart=0x0) returned 0x62 [0205.506] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0205.506] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized", lpFilePart=0x0) returned 0x62 [0205.506] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\", lpFilePart=0x0) returned 0x63 [0205.506] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.506] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.506] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C", cAlternateFileName="")) returned 1 [0205.507] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C", cAlternateFileName="")) returned 0 [0205.507] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0205.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0205.507] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized", lpFilePart=0x0) returned 0x62 [0205.507] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes", lpFilePart=0x0) returned 0x44 [0205.507] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0205.507] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes", lpFilePart=0x0) returned 0x44 [0205.507] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\", lpFilePart=0x0) returned 0x45 [0205.507] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.507] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.508] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d6bf40, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x70a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Custom.theme", cAlternateFileName="CUSTOM~1.THE")) returned 1 [0205.508] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0205.508] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0205.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0205.508] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes", lpFilePart=0x0) returned 0x44 [0205.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0205.508] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes", lpFilePart=0x0) returned 0x44 [0205.508] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\", lpFilePart=0x0) returned 0x45 [0205.508] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.508] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.509] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d6bf40, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x70a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Custom.theme", cAlternateFileName="CUSTOM~1.THE")) returned 1 [0205.509] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d6bf40, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x70a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Custom.theme", cAlternateFileName="CUSTOM~1.THE")) returned 0 [0205.509] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0205.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0205.509] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER", lpFilePart=0x0) returned 0x41 [0205.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0205.509] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER", lpFilePart=0x0) returned 0x41 [0205.509] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\", lpFilePart=0x0) returned 0x42 [0205.509] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.510] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.510] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ERC", cAlternateFileName="")) returned 1 [0205.510] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 1 [0205.510] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 0 [0205.511] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.511] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0205.511] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0205.511] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER", lpFilePart=0x0) returned 0x41 [0205.511] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0205.511] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER", lpFilePart=0x0) returned 0x41 [0205.511] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\", lpFilePart=0x0) returned 0x42 [0205.511] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.511] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.511] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ERC", cAlternateFileName="")) returned 1 [0205.511] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 1 [0205.512] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0205.512] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0205.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0205.512] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC", lpFilePart=0x0) returned 0x45 [0205.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0205.512] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC", lpFilePart=0x0) returned 0x45 [0205.512] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\", lpFilePart=0x0) returned 0x46 [0205.512] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.512] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.513] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0205.513] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0205.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0205.513] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC", lpFilePart=0x0) returned 0x45 [0205.513] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive", lpFilePart=0x0) returned 0x4f [0205.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0205.513] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive", lpFilePart=0x0) returned 0x4f [0205.513] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\", lpFilePart=0x0) returned 0x50 [0205.513] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e45e0 [0205.514] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.514] FindNextFileW (in: hFindFile=0x9e45e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0205.514] FindClose (in: hFindFile=0x9e45e0 | out: hFindFile=0x9e45e0) returned 1 [0205.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0205.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0205.514] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive", lpFilePart=0x0) returned 0x4f [0205.514] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail", lpFilePart=0x0) returned 0x42 [0205.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0205.514] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail", lpFilePart=0x0) returned 0x42 [0205.514] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\", lpFilePart=0x0) returned 0x43 [0205.514] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c881c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0205.572] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c881c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.573] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x5e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount", cAlternateFileName="ACCOUN~3.OEA")) returned 1 [0205.573] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf657b4d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount", cAlternateFileName="ACCOUN~2.OEA")) returned 1 [0205.573] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67b6975, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount", cAlternateFileName="ACCOUN~1.OEA")) returned 1 [0205.573] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b9ed580, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9ed580, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Backup", cAlternateFileName="")) returned 1 [0205.573] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb.chk", cAlternateFileName="")) returned 1 [0205.573] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb.log", cAlternateFileName="")) returned 1 [0205.574] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2b29966, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb00001.log", cAlternateFileName="")) returned 1 [0205.574] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2027392, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edbres00001.jrs", cAlternateFileName="EDBRES~2.JRS")) returned 1 [0205.574] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2216575, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edbres00002.jrs", cAlternateFileName="EDBRES~1.JRS")) returned 1 [0205.574] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="oeold.xml", cAlternateFileName="")) returned 1 [0205.574] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0205.574] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x204000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 1 [0205.574] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9a12c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 1 [0205.574] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0205.575] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0205.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0205.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0205.576] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail", lpFilePart=0x0) returned 0x42 [0205.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0205.576] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail", lpFilePart=0x0) returned 0x42 [0205.576] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\", lpFilePart=0x0) returned 0x43 [0205.576] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c881c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0205.577] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c881c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.577] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x5e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount", cAlternateFileName="ACCOUN~3.OEA")) returned 1 [0205.577] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf657b4d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount", cAlternateFileName="ACCOUN~2.OEA")) returned 1 [0205.577] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67b6975, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount", cAlternateFileName="ACCOUN~1.OEA")) returned 1 [0205.578] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b9ed580, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9ed580, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Backup", cAlternateFileName="")) returned 1 [0205.578] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb.chk", cAlternateFileName="")) returned 1 [0205.578] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb.log", cAlternateFileName="")) returned 1 [0205.578] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2b29966, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb00001.log", cAlternateFileName="")) returned 1 [0205.578] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2027392, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edbres00001.jrs", cAlternateFileName="EDBRES~2.JRS")) returned 1 [0205.578] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2216575, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edbres00002.jrs", cAlternateFileName="EDBRES~1.JRS")) returned 1 [0205.578] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="oeold.xml", cAlternateFileName="")) returned 1 [0205.579] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0205.579] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x204000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 1 [0205.579] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9a12c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 1 [0205.579] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9a12c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 0 [0205.579] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0205.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0205.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0205.580] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup", lpFilePart=0x0) returned 0x49 [0205.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0205.580] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup", lpFilePart=0x0) returned 0x49 [0205.580] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\", lpFilePart=0x0) returned 0x4a [0205.580] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b9ed580, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9ed580, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0205.581] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b9ed580, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9ed580, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.582] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="old", cAlternateFileName="")) returned 1 [0205.582] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="old", cAlternateFileName="")) returned 0 [0205.582] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0205.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0205.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0205.582] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup", lpFilePart=0x0) returned 0x49 [0205.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0205.582] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup", lpFilePart=0x0) returned 0x49 [0205.582] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\", lpFilePart=0x0) returned 0x4a [0205.582] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b9ed580, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9ed580, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0205.582] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b9ed580, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9ed580, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.583] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="old", cAlternateFileName="")) returned 1 [0205.583] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0205.583] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0205.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0205.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0205.583] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old", lpFilePart=0x0) returned 0x4d [0205.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0205.583] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old", lpFilePart=0x0) returned 0x4d [0205.583] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\", lpFilePart=0x0) returned 0x4e [0205.583] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0205.600] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.600] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f2de8d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb00001.log", cAlternateFileName="")) returned 1 [0205.600] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2ab7545, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x206000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 1 [0205.600] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2fec56f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 1 [0205.600] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0205.600] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0205.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0205.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0205.601] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old", lpFilePart=0x0) returned 0x4d [0205.601] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery", lpFilePart=0x0) returned 0x4d [0205.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0205.601] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery", lpFilePart=0x0) returned 0x4d [0205.601] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpFilePart=0x0) returned 0x4e [0205.602] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0205.626] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.626] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0205.627] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.jpg", cAlternateFileName="")) returned 1 [0205.627] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0205.627] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce04b5c8, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.htm", cAlternateFileName="")) returned 1 [0205.627] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.jpg", cAlternateFileName="")) returned 1 [0205.627] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Green Bubbles.htm", cAlternateFileName="GREENB~1.HTM")) returned 1 [0205.627] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x0, dwReserved1=0x0, cFileName="GreenBubbles.jpg", cAlternateFileName="GREENB~1.JPG")) returned 1 [0205.627] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce0bd9df, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hand Prints.htm", cAlternateFileName="HANDPR~1.HTM")) returned 1 [0205.627] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HandPrints.jpg", cAlternateFileName="HANDPR~1.JPG")) returned 1 [0205.628] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce0e3b3c, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Orange Circles.htm", cAlternateFileName="ORANGE~1.HTM")) returned 1 [0205.628] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrangeCircles.jpg", cAlternateFileName="ORANGE~1.JPG")) returned 1 [0205.628] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce109c99, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.htm", cAlternateFileName="")) returned 1 [0205.628] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1 [0205.628] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce12fdf6, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.htm", cAlternateFileName="")) returned 1 [0205.628] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.jpg", cAlternateFileName="")) returned 1 [0205.628] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce17c0b0, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shades of Blue.htm", cAlternateFileName="SHADES~1.HTM")) returned 1 [0205.628] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShadesOfBlue.jpg", cAlternateFileName="SHADES~1.JPG")) returned 1 [0205.629] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce1a220d, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Soft Blue.htm", cAlternateFileName="SOFTBL~1.HTM")) returned 1 [0205.629] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1 [0205.629] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce1c836a, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.htm", cAlternateFileName="")) returned 1 [0205.629] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 1 [0205.629] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0205.629] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0205.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0205.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0205.630] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery", lpFilePart=0x0) returned 0x4d [0205.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0205.630] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery", lpFilePart=0x0) returned 0x4d [0205.630] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpFilePart=0x0) returned 0x4e [0205.630] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0205.631] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.631] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0205.632] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.jpg", cAlternateFileName="")) returned 1 [0205.632] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0205.632] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce04b5c8, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.htm", cAlternateFileName="")) returned 1 [0205.632] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.jpg", cAlternateFileName="")) returned 1 [0205.632] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Green Bubbles.htm", cAlternateFileName="GREENB~1.HTM")) returned 1 [0205.632] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x0, dwReserved1=0x0, cFileName="GreenBubbles.jpg", cAlternateFileName="GREENB~1.JPG")) returned 1 [0205.633] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce0bd9df, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hand Prints.htm", cAlternateFileName="HANDPR~1.HTM")) returned 1 [0205.633] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HandPrints.jpg", cAlternateFileName="HANDPR~1.JPG")) returned 1 [0205.633] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce0e3b3c, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Orange Circles.htm", cAlternateFileName="ORANGE~1.HTM")) returned 1 [0205.633] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrangeCircles.jpg", cAlternateFileName="ORANGE~1.JPG")) returned 1 [0205.633] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce109c99, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.htm", cAlternateFileName="")) returned 1 [0205.634] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1 [0205.634] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce12fdf6, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.htm", cAlternateFileName="")) returned 1 [0205.634] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.jpg", cAlternateFileName="")) returned 1 [0205.634] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce17c0b0, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shades of Blue.htm", cAlternateFileName="SHADES~1.HTM")) returned 1 [0205.635] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShadesOfBlue.jpg", cAlternateFileName="SHADES~1.JPG")) returned 1 [0205.635] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce1a220d, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Soft Blue.htm", cAlternateFileName="SOFTBL~1.HTM")) returned 1 [0205.635] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1 [0205.635] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce1c836a, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.htm", cAlternateFileName="")) returned 1 [0205.635] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 1 [0205.635] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 0 [0205.636] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0205.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0205.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0205.637] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media", lpFilePart=0x0) returned 0x43 [0205.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0205.637] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media", lpFilePart=0x0) returned 0x43 [0205.637] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\", lpFilePart=0x0) returned 0x44 [0205.637] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0205.637] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.638] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="12.0", cAlternateFileName="")) returned 1 [0205.638] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="12.0", cAlternateFileName="")) returned 0 [0205.638] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0205.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0205.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0205.638] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media", lpFilePart=0x0) returned 0x43 [0205.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0205.638] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media", lpFilePart=0x0) returned 0x43 [0205.638] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\", lpFilePart=0x0) returned 0x44 [0205.639] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0205.639] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.639] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="12.0", cAlternateFileName="")) returned 1 [0205.639] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0205.639] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0205.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0205.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0205.639] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0", lpFilePart=0x0) returned 0x48 [0205.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0205.639] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0", lpFilePart=0x0) returned 0x48 [0205.639] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\", lpFilePart=0x0) returned 0x49 [0205.639] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0205.640] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.640] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMSDKNS.DTD", cAlternateFileName="")) returned 1 [0205.640] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9269464, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x27cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMSDKNS.XML", cAlternateFileName="")) returned 1 [0205.640] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0205.640] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0205.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0205.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0205.640] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0", lpFilePart=0x0) returned 0x48 [0205.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0205.640] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0", lpFilePart=0x0) returned 0x48 [0205.640] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\", lpFilePart=0x0) returned 0x49 [0205.640] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0205.641] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.641] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMSDKNS.DTD", cAlternateFileName="")) returned 1 [0205.641] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9269464, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x27cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMSDKNS.XML", cAlternateFileName="")) returned 1 [0205.641] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9269464, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x27cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMSDKNS.XML", cAlternateFileName="")) returned 0 [0205.641] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0205.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0205.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0205.641] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar", lpFilePart=0x0) returned 0x45 [0205.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0205.641] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar", lpFilePart=0x0) returned 0x45 [0205.641] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\", lpFilePart=0x0) returned 0x46 [0205.641] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0205.642] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.642] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gadgets", cAlternateFileName="")) returned 1 [0205.642] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings.ini", cAlternateFileName="")) returned 1 [0205.642] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0205.642] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0205.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0205.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0205.642] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar", lpFilePart=0x0) returned 0x45 [0205.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0205.642] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar", lpFilePart=0x0) returned 0x45 [0205.642] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\", lpFilePart=0x0) returned 0x46 [0205.642] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0205.642] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.643] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gadgets", cAlternateFileName="")) returned 1 [0205.643] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings.ini", cAlternateFileName="")) returned 1 [0205.643] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings.ini", cAlternateFileName="")) returned 0 [0205.643] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0205.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0205.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0205.643] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets", lpFilePart=0x0) returned 0x4d [0205.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0205.643] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets", lpFilePart=0x0) returned 0x4d [0205.643] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\", lpFilePart=0x0) returned 0x4e [0205.643] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0205.643] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.644] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0205.644] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0205.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0205.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0205.644] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets", lpFilePart=0x0) returned 0x4d [0205.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0205.644] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets", lpFilePart=0x0) returned 0x4d [0205.644] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\", lpFilePart=0x0) returned 0x4e [0205.644] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0205.644] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.644] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0205.644] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0205.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0205.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0205.644] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help", nBufferLength=0x105, lpBuffer=0x6a6ea20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help", lpFilePart=0x0) returned 0x3a [0205.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eee8) returned 1 [0205.645] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help", nBufferLength=0x105, lpBuffer=0x6a6e9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help", lpFilePart=0x0) returned 0x3a [0205.645] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\", nBufferLength=0x105, lpBuffer=0x6a6e9c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\", lpFilePart=0x0) returned 0x3b [0205.645] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\*", lpFindFileData=0x6a6ec10 | out: lpFindFileData=0x6a6ec10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.217] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.217] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0206.218] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6eea8) returned 1 [0206.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6eeb4) returned 1 [0206.218] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\.", nBufferLength=0x105, lpBuffer=0x6a6e9a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help", lpFilePart=0x0) returned 0x3a [0206.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee88) returned 1 [0206.218] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help", nBufferLength=0x105, lpBuffer=0x6a6e990, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help", lpFilePart=0x0) returned 0x3a [0206.218] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\", nBufferLength=0x105, lpBuffer=0x6a6e964, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\", lpFilePart=0x0) returned 0x3b [0206.218] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\*", lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.218] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.218] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0206.218] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee48) returned 1 [0206.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee54) returned 1 [0206.219] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla", nBufferLength=0x105, lpBuffer=0x6a6ea20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla", lpFilePart=0x0) returned 0x33 [0206.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eee8) returned 1 [0206.219] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla", nBufferLength=0x105, lpBuffer=0x6a6e9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla", lpFilePart=0x0) returned 0x33 [0206.219] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\", nBufferLength=0x105, lpBuffer=0x6a6e9c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\", lpFilePart=0x0) returned 0x34 [0206.219] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\*", lpFindFileData=0x6a6ec10 | out: lpFindFileData=0x6a6ec10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.220] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.220] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Firefox", cAlternateFileName="")) returned 1 [0206.220] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="updates", cAlternateFileName="")) returned 1 [0206.220] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="updates", cAlternateFileName="")) returned 0 [0206.220] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6eea8) returned 1 [0206.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6eeb4) returned 1 [0206.220] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\.", nBufferLength=0x105, lpBuffer=0x6a6e9a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla", lpFilePart=0x0) returned 0x33 [0206.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee88) returned 1 [0206.221] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla", nBufferLength=0x105, lpBuffer=0x6a6e990, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla", lpFilePart=0x0) returned 0x33 [0206.221] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\", nBufferLength=0x105, lpBuffer=0x6a6e964, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\", lpFilePart=0x0) returned 0x34 [0206.221] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\*", lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.221] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.221] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Firefox", cAlternateFileName="")) returned 1 [0206.221] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="updates", cAlternateFileName="")) returned 1 [0206.221] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0206.221] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee48) returned 1 [0206.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee54) returned 1 [0206.221] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox", lpFilePart=0x0) returned 0x3b [0206.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0206.221] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox", lpFilePart=0x0) returned 0x3b [0206.221] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\", lpFilePart=0x0) returned 0x3c [0206.221] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.222] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.223] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1 [0206.223] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 0 [0206.223] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0206.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0206.223] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox", lpFilePart=0x0) returned 0x3b [0206.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0206.223] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox", lpFilePart=0x0) returned 0x3b [0206.223] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\", lpFilePart=0x0) returned 0x3c [0206.223] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.223] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.223] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1 [0206.223] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0206.223] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0206.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0206.224] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles", lpFilePart=0x0) returned 0x44 [0206.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0206.224] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles", lpFilePart=0x0) returned 0x44 [0206.224] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\", lpFilePart=0x0) returned 0x45 [0206.224] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.225] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.225] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826e2030, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826e2030, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 1 [0206.225] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826e2030, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826e2030, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 0 [0206.225] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0206.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0206.225] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles", lpFilePart=0x0) returned 0x44 [0206.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0206.225] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles", lpFilePart=0x0) returned 0x44 [0206.225] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\", lpFilePart=0x0) returned 0x45 [0206.225] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.226] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.226] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826e2030, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826e2030, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 1 [0206.226] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0206.226] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0206.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0206.226] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default", lpFilePart=0x0) returned 0x55 [0206.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0206.226] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default", lpFilePart=0x0) returned 0x55 [0206.226] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", lpFilePart=0x0) returned 0x56 [0206.226] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826e2030, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826e2030, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.257] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826e2030, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826e2030, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.257] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1 [0206.258] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbece2650, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbecfd400, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbecfd400, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfflineCache", cAlternateFileName="OFFLIN~1")) returned 1 [0206.258] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8234ff30, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="safebrowsing", cAlternateFileName="SAFEBR~2")) returned 1 [0206.258] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x807f0230, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="startupCache", cAlternateFileName="STARTU~1")) returned 1 [0206.258] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb653ec30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x83ce6bb0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x83ce6bb0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbnails", cAlternateFileName="THUMBN~1")) returned 1 [0206.258] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x853a9e10, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0x0, cFileName="_CACHE_CLEAN_", cAlternateFileName="_CACHE~1")) returned 1 [0206.258] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0206.258] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0206.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0206.259] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default", lpFilePart=0x0) returned 0x55 [0206.259] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates", lpFilePart=0x0) returned 0x3b [0206.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0206.259] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates", lpFilePart=0x0) returned 0x3b [0206.259] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\", lpFilePart=0x0) returned 0x3c [0206.259] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.264] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.264] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="E7CF176E110C211B", cAlternateFileName="E7CF17~1")) returned 1 [0206.264] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="E7CF176E110C211B", cAlternateFileName="E7CF17~1")) returned 0 [0206.264] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0206.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0206.265] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates", lpFilePart=0x0) returned 0x3b [0206.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0206.265] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates", lpFilePart=0x0) returned 0x3b [0206.265] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\", lpFilePart=0x0) returned 0x3c [0206.265] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.265] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.265] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="E7CF176E110C211B", cAlternateFileName="E7CF17~1")) returned 1 [0206.265] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0206.265] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0206.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0206.265] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B", lpFilePart=0x0) returned 0x4c [0206.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0206.265] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B", lpFilePart=0x0) returned 0x4c [0206.265] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\", lpFilePart=0x0) returned 0x4d [0206.265] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.349] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.350] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80a2b6d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x464, dwReserved0=0x0, dwReserved1=0x0, cFileName="active-update.xml", cAlternateFileName="ACTIVE~1.XML")) returned 1 [0206.350] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb74b7b30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb74b7b30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="updates", cAlternateFileName="")) returned 1 [0206.350] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80a9daf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8548e650, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8548e650, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x39, dwReserved0=0x0, dwReserved1=0x0, cFileName="updates.xml", cAlternateFileName="")) returned 1 [0206.350] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0206.350] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0206.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0206.351] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B", lpFilePart=0x0) returned 0x4c [0206.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0206.351] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B", lpFilePart=0x0) returned 0x4c [0206.351] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\", lpFilePart=0x0) returned 0x4d [0206.351] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.352] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.352] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80a2b6d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x464, dwReserved0=0x0, dwReserved1=0x0, cFileName="active-update.xml", cAlternateFileName="ACTIVE~1.XML")) returned 1 [0206.352] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb74b7b30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb74b7b30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="updates", cAlternateFileName="")) returned 1 [0206.352] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80a9daf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8548e650, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8548e650, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x39, dwReserved0=0x0, dwReserved1=0x0, cFileName="updates.xml", cAlternateFileName="")) returned 1 [0206.352] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80a9daf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8548e650, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8548e650, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x39, dwReserved0=0x0, dwReserved1=0x0, cFileName="updates.xml", cAlternateFileName="")) returned 0 [0206.352] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0206.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0206.353] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates", lpFilePart=0x0) returned 0x54 [0206.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0206.353] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates", lpFilePart=0x0) returned 0x54 [0206.353] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\", lpFilePart=0x0) returned 0x55 [0206.353] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb74b7b30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb74b7b30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.354] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb74b7b30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb74b7b30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.355] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80a2b6d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80a2b6d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0", cAlternateFileName="")) returned 1 [0206.355] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80a2b6d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80a2b6d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0", cAlternateFileName="")) returned 0 [0206.355] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0206.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0206.355] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates", lpFilePart=0x0) returned 0x54 [0206.355] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x6a6ea20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x30 [0206.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eee8) returned 1 [0206.355] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x6a6e9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x30 [0206.355] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x6a6e9c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x31 [0206.355] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\*", lpFindFileData=0x6a6ec10 | out: lpFindFileData=0x6a6ec10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x35fc1fa0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x35fc1fa0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.355] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x35fc1fa0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x35fc1fa0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.355] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x513882c0, ftCreationTime.dwHighDateTime=0x1d5e639, ftLastAccessTime.dwLowDateTime=0xa93da3d0, ftLastAccessTime.dwHighDateTime=0x1d5e25e, ftLastWriteTime.dwLowDateTime=0xa93da3d0, ftLastWriteTime.dwHighDateTime=0x1d5e25e, nFileSizeHigh=0x0, nFileSizeLow=0x33f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="2Z8kQwlSPW.avi", cAlternateFileName="2Z8KQW~1.AVI")) returned 1 [0206.355] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8aa26310, ftCreationTime.dwHighDateTime=0x1d5e304, ftLastAccessTime.dwLowDateTime=0x68df32d0, ftLastAccessTime.dwHighDateTime=0x1d5e575, ftLastWriteTime.dwLowDateTime=0x68df32d0, ftLastWriteTime.dwHighDateTime=0x1d5e575, nFileSizeHigh=0x0, nFileSizeLow=0x1778a, dwReserved0=0x0, dwReserved1=0x0, cFileName="4 gCmsKJ4.odp", cAlternateFileName="4GCMSK~1.ODP")) returned 1 [0206.355] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x88265730, ftCreationTime.dwHighDateTime=0x1d5dc0c, ftLastAccessTime.dwLowDateTime=0xf362d1d0, ftLastAccessTime.dwHighDateTime=0x1d5d992, ftLastWriteTime.dwLowDateTime=0xf362d1d0, ftLastWriteTime.dwHighDateTime=0x1d5d992, nFileSizeHigh=0x0, nFileSizeLow=0x3902, dwReserved0=0x0, dwReserved1=0x0, cFileName="5-au8sTR_DKW.bmp", cAlternateFileName="5-AU8S~1.BMP")) returned 1 [0206.356] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84e753a0, ftCreationTime.dwHighDateTime=0x1d5e5e2, ftLastAccessTime.dwLowDateTime=0x45006620, ftLastAccessTime.dwHighDateTime=0x1d5da5f, ftLastWriteTime.dwLowDateTime=0x45006620, ftLastWriteTime.dwHighDateTime=0x1d5da5f, nFileSizeHigh=0x0, nFileSizeLow=0x350e, dwReserved0=0x0, dwReserved1=0x0, cFileName="57qTz_2cSF05D7BsCcc.pps", cAlternateFileName="57QTZ_~1.PPS")) returned 1 [0206.356] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe0cff6c0, ftCreationTime.dwHighDateTime=0x1d5e062, ftLastAccessTime.dwLowDateTime=0xb986d250, ftLastAccessTime.dwHighDateTime=0x1d5e6d9, ftLastWriteTime.dwLowDateTime=0xb986d250, ftLastWriteTime.dwHighDateTime=0x1d5e6d9, nFileSizeHigh=0x0, nFileSizeLow=0x5964, dwReserved0=0x0, dwReserved1=0x0, cFileName="6o74G.mp3", cAlternateFileName="")) returned 1 [0206.356] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe58ff980, ftCreationTime.dwHighDateTime=0x1d5dee6, ftLastAccessTime.dwLowDateTime=0x73d64b0, ftLastAccessTime.dwHighDateTime=0x1d5dfe0, ftLastWriteTime.dwLowDateTime=0x73d64b0, ftLastWriteTime.dwHighDateTime=0x1d5dfe0, nFileSizeHigh=0x0, nFileSizeLow=0x100fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="7OhdXa3ktL4-VE8Up.mkv", cAlternateFileName="7OHDXA~1.MKV")) returned 1 [0206.356] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf3e40c90, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf3e40c90, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9df274b54410817b3690312b4cb55431", cAlternateFileName="9DF274~1")) returned 1 [0206.356] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a0318e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x6a0318e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x32d9b1c0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x900, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeARM.log", cAlternateFileName="")) returned 1 [0206.356] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6be9bb00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x6be9bb00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x6be9bb00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bst449D.tmp", cAlternateFileName="")) returned 1 [0206.356] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5ca50, ftCreationTime.dwHighDateTime=0x1d5d89c, ftLastAccessTime.dwLowDateTime=0x6b882ea0, ftLastAccessTime.dwHighDateTime=0x1d5e729, ftLastWriteTime.dwLowDateTime=0x6b882ea0, ftLastWriteTime.dwHighDateTime=0x1d5e729, nFileSizeHigh=0x0, nFileSizeLow=0x3641, dwReserved0=0x0, dwReserved1=0x0, cFileName="BXPtYk9CKQNZ.bmp", cAlternateFileName="BXPTYK~1.BMP")) returned 1 [0206.356] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0206.356] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7adf8600, ftCreationTime.dwHighDateTime=0x1d5e012, ftLastAccessTime.dwLowDateTime=0xda8116a0, ftLastAccessTime.dwHighDateTime=0x1d5e44f, ftLastWriteTime.dwLowDateTime=0xda8116a0, ftLastWriteTime.dwHighDateTime=0x1d5e44f, nFileSizeHigh=0x0, nFileSizeLow=0x17a7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="d_9fzjXN59RtsG6FF.wav", cAlternateFileName="D_9FZJ~1.WAV")) returned 1 [0206.356] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa53eae00, ftCreationTime.dwHighDateTime=0x1d5e786, ftLastAccessTime.dwLowDateTime=0xb4ad3980, ftLastAccessTime.dwHighDateTime=0x1d5e4e6, ftLastWriteTime.dwLowDateTime=0xb4ad3980, ftLastWriteTime.dwHighDateTime=0x1d5e4e6, nFileSizeHigh=0x0, nFileSizeLow=0x309d, dwReserved0=0x0, dwReserved1=0x0, cFileName="EJsyP17Z.csv", cAlternateFileName="")) returned 1 [0206.356] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb84a230, ftCreationTime.dwHighDateTime=0x1d5de96, ftLastAccessTime.dwLowDateTime=0x91f8d5a0, ftLastAccessTime.dwHighDateTime=0x1d5e49d, ftLastWriteTime.dwLowDateTime=0x91f8d5a0, ftLastWriteTime.dwHighDateTime=0x1d5e49d, nFileSizeHigh=0x0, nFileSizeLow=0x51a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="F1_TNQKi1ckgpfT.docx", cAlternateFileName="F1_TNQ~1.DOC")) returned 1 [0206.356] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33d9ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x33d9ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FXSAPIDebugLogFile.txt", cAlternateFileName="FXSAPI~1.TXT")) returned 1 [0206.356] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1804b30, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf1804b30, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0x408bb4d0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x94, dwReserved0=0x0, dwReserved1=0x0, cFileName="gpustats.bx", cAlternateFileName="")) returned 1 [0206.356] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9a5f1ab0, ftCreationTime.dwHighDateTime=0x1d5dbe7, ftLastAccessTime.dwLowDateTime=0x4a85c690, ftLastAccessTime.dwHighDateTime=0x1d5e0f8, ftLastWriteTime.dwLowDateTime=0x4a85c690, ftLastWriteTime.dwHighDateTime=0x1d5e0f8, nFileSizeHigh=0x0, nFileSizeLow=0x273e, dwReserved0=0x0, dwReserved1=0x0, cFileName="hI7dcq.wav", cAlternateFileName="")) returned 1 [0206.356] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0206.356] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x17aa39b0, ftCreationTime.dwHighDateTime=0x1d5d7d7, ftLastAccessTime.dwLowDateTime=0xbc1dbdd0, ftLastAccessTime.dwHighDateTime=0x1d5dc39, ftLastWriteTime.dwLowDateTime=0xbc1dbdd0, ftLastWriteTime.dwHighDateTime=0x1d5dc39, nFileSizeHigh=0x0, nFileSizeLow=0xeaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="jjjiPdyoEp5H.jpg", cAlternateFileName="JJJIPD~1.JPG")) returned 1 [0206.356] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1158a930, ftCreationTime.dwHighDateTime=0x1d5e7f3, ftLastAccessTime.dwLowDateTime=0xebb4dc10, ftLastAccessTime.dwHighDateTime=0x1d5e4c0, ftLastWriteTime.dwLowDateTime=0xebb4dc10, ftLastWriteTime.dwHighDateTime=0x1d5e4c0, nFileSizeHigh=0x0, nFileSizeLow=0x1e98, dwReserved0=0x0, dwReserved1=0x0, cFileName="KnapLok_XqWA.mp3", cAlternateFileName="KNAPLO~1.MP3")) returned 1 [0206.356] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x950b5510, ftCreationTime.dwHighDateTime=0x1d5e295, ftLastAccessTime.dwLowDateTime=0xa3334ea0, ftLastAccessTime.dwHighDateTime=0x1d5d8d5, ftLastWriteTime.dwLowDateTime=0xa3334ea0, ftLastWriteTime.dwHighDateTime=0x1d5d8d5, nFileSizeHigh=0x0, nFileSizeLow=0xad0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="LcuZSRQ81m.bmp", cAlternateFileName="LCUZSR~1.BMP")) returned 1 [0206.356] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c67fd30, ftCreationTime.dwHighDateTime=0x1d5dd11, ftLastAccessTime.dwLowDateTime=0x903b17a0, ftLastAccessTime.dwHighDateTime=0x1d5d93a, ftLastWriteTime.dwLowDateTime=0x903b17a0, ftLastWriteTime.dwHighDateTime=0x1d5d93a, nFileSizeHigh=0x0, nFileSizeLow=0x1258, dwReserved0=0x0, dwReserved1=0x0, cFileName="LGBlh.png", cAlternateFileName="")) returned 1 [0206.356] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef4c66b0, ftCreationTime.dwHighDateTime=0x1d5da78, ftLastAccessTime.dwLowDateTime=0x85fc9b20, ftLastAccessTime.dwHighDateTime=0x1d5d7b3, ftLastWriteTime.dwLowDateTime=0x85fc9b20, ftLastWriteTime.dwHighDateTime=0x1d5d7b3, nFileSizeHigh=0x0, nFileSizeLow=0x9a51, dwReserved0=0x0, dwReserved1=0x0, cFileName="lPhqwdd.mkv", cAlternateFileName="")) returned 1 [0206.357] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x67ed1350, ftCreationTime.dwHighDateTime=0x1d5dcb1, ftLastAccessTime.dwLowDateTime=0x5b143350, ftLastAccessTime.dwHighDateTime=0x1d5e000, ftLastWriteTime.dwLowDateTime=0x5b143350, ftLastWriteTime.dwHighDateTime=0x1d5e000, nFileSizeHigh=0x0, nFileSizeLow=0x274d, dwReserved0=0x0, dwReserved1=0x0, cFileName="lUUqXpadmhf.gif", cAlternateFileName="LUUQXP~1.GIF")) returned 1 [0206.357] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda42f130, ftCreationTime.dwHighDateTime=0x1d5d893, ftLastAccessTime.dwLowDateTime=0x95a0280, ftLastAccessTime.dwHighDateTime=0x1d5e2a6, ftLastWriteTime.dwLowDateTime=0x95a0280, ftLastWriteTime.dwHighDateTime=0x1d5e2a6, nFileSizeHigh=0x0, nFileSizeLow=0x17a2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="mVNMnSYtuQS.avi", cAlternateFileName="MVNMNS~1.AVI")) returned 1 [0206.357] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1a20dc80, ftCreationTime.dwHighDateTime=0x1d5e2ef, ftLastAccessTime.dwLowDateTime=0x4320ae30, ftLastAccessTime.dwHighDateTime=0x1d5daa2, ftLastWriteTime.dwLowDateTime=0x4320ae30, ftLastWriteTime.dwHighDateTime=0x1d5daa2, nFileSizeHigh=0x0, nFileSizeLow=0x8b09, dwReserved0=0x0, dwReserved1=0x0, cFileName="n3GtYqkuzgbfFej.bmp", cAlternateFileName="N3GTYQ~1.BMP")) returned 1 [0206.357] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42d5aff0, ftCreationTime.dwHighDateTime=0x1d5e4bd, ftLastAccessTime.dwLowDateTime=0xa3223490, ftLastAccessTime.dwHighDateTime=0x1d5de9c, ftLastWriteTime.dwLowDateTime=0xa3223490, ftLastWriteTime.dwHighDateTime=0x1d5de9c, nFileSizeHigh=0x0, nFileSizeLow=0x17b1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NQd6iEWAJJNDx9.swf", cAlternateFileName="NQD6IE~1.SWF")) returned 1 [0206.357] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x118b2650, ftCreationTime.dwHighDateTime=0x1d5ddec, ftLastAccessTime.dwLowDateTime=0x8c619c60, ftLastAccessTime.dwHighDateTime=0x1d5df2c, ftLastWriteTime.dwLowDateTime=0x8c619c60, ftLastWriteTime.dwHighDateTime=0x1d5df2c, nFileSizeHigh=0x0, nFileSizeLow=0x6d4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="pf8VR.doc", cAlternateFileName="")) returned 1 [0206.357] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xca0072f0, ftCreationTime.dwHighDateTime=0x1d5e43e, ftLastAccessTime.dwLowDateTime=0x488f7650, ftLastAccessTime.dwHighDateTime=0x1d5e702, ftLastWriteTime.dwLowDateTime=0x488f7650, ftLastWriteTime.dwHighDateTime=0x1d5e702, nFileSizeHigh=0x0, nFileSizeLow=0x1d2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="puMUyOkInN5vYu.bmp", cAlternateFileName="PUMUYO~1.BMP")) returned 1 [0206.357] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf67c2c30, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf67c2c30, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0x44841ff0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ran.bx", cAlternateFileName="")) returned 1 [0206.357] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfb72aa0, ftCreationTime.dwHighDateTime=0x1d5e7a5, ftLastAccessTime.dwLowDateTime=0x7ff5690, ftLastAccessTime.dwHighDateTime=0x1d5d808, ftLastWriteTime.dwLowDateTime=0x7ff5690, ftLastWriteTime.dwHighDateTime=0x1d5d808, nFileSizeHigh=0x0, nFileSizeLow=0x6e48, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGjKRO.bmp", cAlternateFileName="")) returned 1 [0206.357] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa89f0ac0, ftCreationTime.dwHighDateTime=0x1d5e6fc, ftLastAccessTime.dwLowDateTime=0xe0bf87e0, ftLastAccessTime.dwHighDateTime=0x1d5e3d7, ftLastWriteTime.dwLowDateTime=0xe0bf87e0, ftLastWriteTime.dwHighDateTime=0x1d5e3d7, nFileSizeHigh=0x0, nFileSizeLow=0x28a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="rukJ2ki9DOoDHhK.mp3", cAlternateFileName="RUKJ2K~1.MP3")) returned 1 [0206.357] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0206.357] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x31f5580, ftCreationTime.dwHighDateTime=0x1d5e294, ftLastAccessTime.dwLowDateTime=0xd0dd62b0, ftLastAccessTime.dwHighDateTime=0x1d5dd66, ftLastWriteTime.dwLowDateTime=0xd0dd62b0, ftLastWriteTime.dwHighDateTime=0x1d5dd66, nFileSizeHigh=0x0, nFileSizeLow=0x14645, dwReserved0=0x0, dwReserved1=0x0, cFileName="TgReyANn2kjAJUG9.png", cAlternateFileName="TGREYA~1.PNG")) returned 1 [0206.357] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x65818490, ftCreationTime.dwHighDateTime=0x1d5e493, ftLastAccessTime.dwLowDateTime=0x6af43ce0, ftLastAccessTime.dwHighDateTime=0x1d5de32, ftLastWriteTime.dwLowDateTime=0x6af43ce0, ftLastWriteTime.dwHighDateTime=0x1d5de32, nFileSizeHigh=0x0, nFileSizeLow=0xc74a, dwReserved0=0x0, dwReserved1=0x0, cFileName="tkAF 9Ybmddq50wDQaF.wav", cAlternateFileName="TKAF9Y~1.WAV")) returned 1 [0206.357] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb9717ff0, ftCreationTime.dwHighDateTime=0x1d5dcf1, ftLastAccessTime.dwLowDateTime=0xda373160, ftLastAccessTime.dwHighDateTime=0x1d5dfe6, ftLastWriteTime.dwLowDateTime=0xda373160, ftLastWriteTime.dwHighDateTime=0x1d5dfe6, nFileSizeHigh=0x0, nFileSizeLow=0x7527, dwReserved0=0x0, dwReserved1=0x0, cFileName="tzH31l45.jpg", cAlternateFileName="")) returned 1 [0206.357] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x92470b00, ftCreationTime.dwHighDateTime=0x1d5da3c, ftLastAccessTime.dwLowDateTime=0x36dca210, ftLastAccessTime.dwHighDateTime=0x1d5e2fd, ftLastWriteTime.dwLowDateTime=0x36dca210, ftLastWriteTime.dwHighDateTime=0x1d5e2fd, nFileSizeHigh=0x0, nFileSizeLow=0xbb08, dwReserved0=0x0, dwReserved1=0x0, cFileName="US-VXYmW_QdpRyP4RM1Z.xls", cAlternateFileName="US-VXY~1.XLS")) returned 1 [0206.357] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x89aadc0, ftCreationTime.dwHighDateTime=0x1d5d86c, ftLastAccessTime.dwLowDateTime=0xa9de8de0, ftLastAccessTime.dwHighDateTime=0x1d5e402, ftLastWriteTime.dwLowDateTime=0xa9de8de0, ftLastWriteTime.dwHighDateTime=0x1d5e402, nFileSizeHigh=0x0, nFileSizeLow=0x3c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="vor0Oy7pcXjnQD6PP.swf", cAlternateFileName="VOR0OY~1.SWF")) returned 1 [0206.357] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x35fc1fa0, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x35fc1fa0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x35fc1fa0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPDNSE", cAlternateFileName="")) returned 1 [0206.357] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2baaf60, ftCreationTime.dwHighDateTime=0x1d5ddf6, ftLastAccessTime.dwLowDateTime=0x75b2e5d0, ftLastAccessTime.dwHighDateTime=0x1d5de0c, ftLastWriteTime.dwLowDateTime=0x75b2e5d0, ftLastWriteTime.dwHighDateTime=0x1d5de0c, nFileSizeHigh=0x0, nFileSizeLow=0x7305, dwReserved0=0x0, dwReserved1=0x0, cFileName="wZuI0X8AKAWESBdA.avi", cAlternateFileName="WZUI0X~1.AVI")) returned 1 [0206.357] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcbf8a4a0, ftCreationTime.dwHighDateTime=0x1d5dc97, ftLastAccessTime.dwLowDateTime=0x407045a0, ftLastAccessTime.dwHighDateTime=0x1d5e331, ftLastWriteTime.dwLowDateTime=0x407045a0, ftLastWriteTime.dwHighDateTime=0x1d5e331, nFileSizeHigh=0x0, nFileSizeLow=0x18006, dwReserved0=0x0, dwReserved1=0x0, cFileName="YsijQxuL.wav", cAlternateFileName="")) returned 1 [0206.357] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3c8b92d0, ftCreationTime.dwHighDateTime=0x1d5e51d, ftLastAccessTime.dwLowDateTime=0x3f3caac0, ftLastAccessTime.dwHighDateTime=0x1d5dca6, ftLastWriteTime.dwLowDateTime=0x3f3caac0, ftLastWriteTime.dwHighDateTime=0x1d5dca6, nFileSizeHigh=0x0, nFileSizeLow=0xfd1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="zQJQyNI.pps", cAlternateFileName="")) returned 1 [0206.358] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0206.358] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6eea8) returned 1 [0206.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6eeb4) returned 1 [0206.358] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\.", nBufferLength=0x105, lpBuffer=0x6a6e9a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x30 [0206.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee88) returned 1 [0206.358] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x6a6e990, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x30 [0206.358] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x6a6e964, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x31 [0206.358] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\*", lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x35fc1fa0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x35fc1fa0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.358] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x35fc1fa0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x35fc1fa0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.358] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x513882c0, ftCreationTime.dwHighDateTime=0x1d5e639, ftLastAccessTime.dwLowDateTime=0xa93da3d0, ftLastAccessTime.dwHighDateTime=0x1d5e25e, ftLastWriteTime.dwLowDateTime=0xa93da3d0, ftLastWriteTime.dwHighDateTime=0x1d5e25e, nFileSizeHigh=0x0, nFileSizeLow=0x33f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="2Z8kQwlSPW.avi", cAlternateFileName="2Z8KQW~1.AVI")) returned 1 [0206.358] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8aa26310, ftCreationTime.dwHighDateTime=0x1d5e304, ftLastAccessTime.dwLowDateTime=0x68df32d0, ftLastAccessTime.dwHighDateTime=0x1d5e575, ftLastWriteTime.dwLowDateTime=0x68df32d0, ftLastWriteTime.dwHighDateTime=0x1d5e575, nFileSizeHigh=0x0, nFileSizeLow=0x1778a, dwReserved0=0x0, dwReserved1=0x0, cFileName="4 gCmsKJ4.odp", cAlternateFileName="4GCMSK~1.ODP")) returned 1 [0206.358] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x88265730, ftCreationTime.dwHighDateTime=0x1d5dc0c, ftLastAccessTime.dwLowDateTime=0xf362d1d0, ftLastAccessTime.dwHighDateTime=0x1d5d992, ftLastWriteTime.dwLowDateTime=0xf362d1d0, ftLastWriteTime.dwHighDateTime=0x1d5d992, nFileSizeHigh=0x0, nFileSizeLow=0x3902, dwReserved0=0x0, dwReserved1=0x0, cFileName="5-au8sTR_DKW.bmp", cAlternateFileName="5-AU8S~1.BMP")) returned 1 [0206.358] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84e753a0, ftCreationTime.dwHighDateTime=0x1d5e5e2, ftLastAccessTime.dwLowDateTime=0x45006620, ftLastAccessTime.dwHighDateTime=0x1d5da5f, ftLastWriteTime.dwLowDateTime=0x45006620, ftLastWriteTime.dwHighDateTime=0x1d5da5f, nFileSizeHigh=0x0, nFileSizeLow=0x350e, dwReserved0=0x0, dwReserved1=0x0, cFileName="57qTz_2cSF05D7BsCcc.pps", cAlternateFileName="57QTZ_~1.PPS")) returned 1 [0206.358] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe0cff6c0, ftCreationTime.dwHighDateTime=0x1d5e062, ftLastAccessTime.dwLowDateTime=0xb986d250, ftLastAccessTime.dwHighDateTime=0x1d5e6d9, ftLastWriteTime.dwLowDateTime=0xb986d250, ftLastWriteTime.dwHighDateTime=0x1d5e6d9, nFileSizeHigh=0x0, nFileSizeLow=0x5964, dwReserved0=0x0, dwReserved1=0x0, cFileName="6o74G.mp3", cAlternateFileName="")) returned 1 [0206.358] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe58ff980, ftCreationTime.dwHighDateTime=0x1d5dee6, ftLastAccessTime.dwLowDateTime=0x73d64b0, ftLastAccessTime.dwHighDateTime=0x1d5dfe0, ftLastWriteTime.dwLowDateTime=0x73d64b0, ftLastWriteTime.dwHighDateTime=0x1d5dfe0, nFileSizeHigh=0x0, nFileSizeLow=0x100fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="7OhdXa3ktL4-VE8Up.mkv", cAlternateFileName="7OHDXA~1.MKV")) returned 1 [0206.358] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf3e40c90, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf3e40c90, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9df274b54410817b3690312b4cb55431", cAlternateFileName="9DF274~1")) returned 1 [0206.358] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a0318e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x6a0318e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x32d9b1c0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x900, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeARM.log", cAlternateFileName="")) returned 1 [0206.359] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6be9bb00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x6be9bb00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x6be9bb00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bst449D.tmp", cAlternateFileName="")) returned 1 [0206.359] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5ca50, ftCreationTime.dwHighDateTime=0x1d5d89c, ftLastAccessTime.dwLowDateTime=0x6b882ea0, ftLastAccessTime.dwHighDateTime=0x1d5e729, ftLastWriteTime.dwLowDateTime=0x6b882ea0, ftLastWriteTime.dwHighDateTime=0x1d5e729, nFileSizeHigh=0x0, nFileSizeLow=0x3641, dwReserved0=0x0, dwReserved1=0x0, cFileName="BXPtYk9CKQNZ.bmp", cAlternateFileName="BXPTYK~1.BMP")) returned 1 [0206.359] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0206.359] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee48) returned 1 [0206.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee54) returned 1 [0206.359] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431", lpFilePart=0x0) returned 0x51 [0206.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0206.360] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431", lpFilePart=0x0) returned 0x51 [0206.360] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\", lpFilePart=0x0) returned 0x52 [0206.360] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf3e40c90, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf3e40c90, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.360] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0206.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0206.360] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431", lpFilePart=0x0) returned 0x51 [0206.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0206.360] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431", lpFilePart=0x0) returned 0x51 [0206.361] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\", lpFilePart=0x0) returned 0x52 [0206.361] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf3e40c90, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf3e40c90, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.361] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0206.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0206.361] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", lpFilePart=0x0) returned 0x72 [0206.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0206.361] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", lpFilePart=0x0) returned 0x72 [0206.361] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\", lpFilePart=0x0) returned 0x73 [0206.361] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0x46a9fd90, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x46a9fd90, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.361] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0206.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0206.361] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", lpFilePart=0x0) returned 0x72 [0206.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0206.361] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89", lpFilePart=0x0) returned 0x72 [0206.362] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\", lpFilePart=0x0) returned 0x73 [0206.362] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xf3e40c90, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0x46a9fd90, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x46a9fd90, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.362] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0206.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0206.362] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs", lpFilePart=0x0) returned 0x76 [0206.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0206.362] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs", lpFilePart=0x0) returned 0x76 [0206.362] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\", lpFilePart=0x0) returned 0x77 [0206.362] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x46a9fd90, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x46a9fd90, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x46a9fd90, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.362] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0206.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0206.362] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\DBs", lpFilePart=0x0) returned 0x76 [0206.362] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs", lpFilePart=0x0) returned 0x77 [0206.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0206.363] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs", lpFilePart=0x0) returned 0x77 [0206.363] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\", lpFilePart=0x0) returned 0x78 [0206.363] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42c49d70, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x43dfe110, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x43dfe110, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.363] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0206.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0206.363] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Dirs", lpFilePart=0x0) returned 0x77 [0206.363] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies", lpFilePart=0x0) returned 0x38 [0206.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0206.363] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies", lpFilePart=0x0) returned 0x38 [0206.363] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\", lpFilePart=0x0) returned 0x39 [0206.363] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.363] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0206.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0206.363] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies", lpFilePart=0x0) returned 0x38 [0206.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0206.364] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies", lpFilePart=0x0) returned 0x38 [0206.364] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\", lpFilePart=0x0) returned 0x39 [0206.364] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.364] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0206.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0206.364] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History", lpFilePart=0x0) returned 0x38 [0206.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0206.364] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History", lpFilePart=0x0) returned 0x38 [0206.364] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\", lpFilePart=0x0) returned 0x39 [0206.364] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.364] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0206.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0206.364] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History", lpFilePart=0x0) returned 0x38 [0206.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0206.364] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History", lpFilePart=0x0) returned 0x38 [0206.365] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\", lpFilePart=0x0) returned 0x39 [0206.365] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.365] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0206.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0206.365] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5", lpFilePart=0x0) returned 0x44 [0206.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0206.365] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5", lpFilePart=0x0) returned 0x44 [0206.365] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\", lpFilePart=0x0) returned 0x45 [0206.365] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.365] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0206.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0206.365] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5", lpFilePart=0x0) returned 0x44 [0206.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0206.365] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5", lpFilePart=0x0) returned 0x44 [0206.365] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\", lpFilePart=0x0) returned 0x45 [0206.365] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.366] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0206.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0206.366] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files", lpFilePart=0x0) returned 0x49 [0206.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0206.366] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files", lpFilePart=0x0) returned 0x49 [0206.366] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\", lpFilePart=0x0) returned 0x4a [0206.366] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.366] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0206.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0206.366] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files", lpFilePart=0x0) returned 0x49 [0206.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0206.366] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files", lpFilePart=0x0) returned 0x49 [0206.366] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\", lpFilePart=0x0) returned 0x4a [0206.366] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.367] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0206.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0206.367] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5", lpFilePart=0x0) returned 0x55 [0206.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0206.367] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5", lpFilePart=0x0) returned 0x55 [0206.367] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\", lpFilePart=0x0) returned 0x56 [0206.367] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.367] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0206.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0206.367] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5", lpFilePart=0x0) returned 0x55 [0206.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0206.367] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5", lpFilePart=0x0) returned 0x55 [0206.367] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\", lpFilePart=0x0) returned 0x56 [0206.367] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.368] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0206.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0206.368] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0", lpFilePart=0x0) returned 0x5e [0206.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0206.368] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0", lpFilePart=0x0) returned 0x5e [0206.368] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\", lpFilePart=0x0) returned 0x5f [0206.368] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.368] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0206.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0206.368] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0", lpFilePart=0x0) returned 0x5e [0206.368] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D", lpFilePart=0x0) returned 0x5e [0206.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0206.368] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D", lpFilePart=0x0) returned 0x5e [0206.368] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\", lpFilePart=0x0) returned 0x5f [0206.368] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.369] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0206.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0206.369] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D", lpFilePart=0x0) returned 0x5e [0206.369] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB", lpFilePart=0x0) returned 0x5e [0206.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0206.369] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB", lpFilePart=0x0) returned 0x5e [0206.369] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\", lpFilePart=0x0) returned 0x5f [0206.369] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.369] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0206.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0206.369] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB", lpFilePart=0x0) returned 0x5e [0206.369] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9", lpFilePart=0x0) returned 0x5e [0206.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0206.369] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9", lpFilePart=0x0) returned 0x5e [0206.370] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\", lpFilePart=0x0) returned 0x5f [0206.370] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.370] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0206.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0206.370] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9", lpFilePart=0x0) returned 0x5e [0206.370] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE", lpFilePart=0x0) returned 0x37 [0206.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0206.370] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE", lpFilePart=0x0) returned 0x37 [0206.370] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE\\", lpFilePart=0x0) returned 0x38 [0206.370] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x35fc1fa0, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x35fc1fa0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x35fc1fa0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.370] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0206.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0206.370] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE", lpFilePart=0x0) returned 0x37 [0206.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0206.370] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE", lpFilePart=0x0) returned 0x37 [0206.371] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE\\", lpFilePart=0x0) returned 0x38 [0206.371] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x35fc1fa0, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x35fc1fa0, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x35fc1fa0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.371] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0206.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0206.371] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files", nBufferLength=0x105, lpBuffer=0x6a6ea20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files", lpFilePart=0x0) returned 0x44 [0206.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eee8) returned 1 [0206.371] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files", nBufferLength=0x105, lpBuffer=0x6a6e9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files", lpFilePart=0x0) returned 0x44 [0206.371] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files\\", nBufferLength=0x105, lpBuffer=0x6a6e9c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files\\", lpFilePart=0x0) returned 0x45 [0206.371] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files\\*", lpFindFileData=0x6a6ec10 | out: lpFindFileData=0x6a6ec10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0206.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6eeac) returned 1 [0206.375] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore", nBufferLength=0x105, lpBuffer=0x6a6ea20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore", lpFilePart=0x0) returned 0x38 [0206.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eee8) returned 1 [0206.375] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore", nBufferLength=0x105, lpBuffer=0x6a6e9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore", lpFilePart=0x0) returned 0x38 [0206.376] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\", nBufferLength=0x105, lpBuffer=0x6a6e9c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\", lpFilePart=0x0) returned 0x39 [0206.376] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\*", lpFindFileData=0x6a6ec10 | out: lpFindFileData=0x6a6ec10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.376] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.376] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0206.376] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6eea8) returned 1 [0206.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6eeb4) returned 1 [0206.376] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\.", nBufferLength=0x105, lpBuffer=0x6a6e9a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore", lpFilePart=0x0) returned 0x38 [0206.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee88) returned 1 [0206.377] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore", nBufferLength=0x105, lpBuffer=0x6a6e990, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore", lpFilePart=0x0) returned 0x38 [0206.377] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\", nBufferLength=0x105, lpBuffer=0x6a6e964, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\", lpFilePart=0x0) returned 0x39 [0206.377] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\*", lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.377] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.377] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0206.377] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee48) returned 1 [0206.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee54) returned 1 [0206.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eef8) returned 1 [0206.378] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x6a6ea00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpFilePart=0x0) returned 0x2d [0206.378] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", nBufferLength=0x105, lpBuffer=0x6a6e9d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpFilePart=0x0) returned 0x2e [0206.378] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*", lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdc08eaa0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc08eaa0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.378] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdc08eaa0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc08eaa0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.378] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x18bf5a80, ftCreationTime.dwHighDateTime=0x1d5dfeb, ftLastAccessTime.dwLowDateTime=0xff618cc0, ftLastAccessTime.dwHighDateTime=0x1d5de0a, ftLastWriteTime.dwLowDateTime=0xff618cc0, ftLastWriteTime.dwHighDateTime=0x1d5de0a, nFileSizeHigh=0x0, nFileSizeLow=0x14d94, dwReserved0=0x0, dwReserved1=0x0, cFileName="-vZVUVFR1S6QEY6YJ3D.avi", cAlternateFileName="-VZVUV~1.AVI")) returned 1 [0206.379] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd7ef49e0, ftCreationTime.dwHighDateTime=0x1d5e32b, ftLastAccessTime.dwLowDateTime=0xf1a63370, ftLastAccessTime.dwHighDateTime=0x1d5e142, ftLastWriteTime.dwLowDateTime=0xf1a63370, ftLastWriteTime.dwHighDateTime=0x1d5e142, nFileSizeHigh=0x0, nFileSizeLow=0x16571, dwReserved0=0x0, dwReserved1=0x0, cFileName="0dK9D.png", cAlternateFileName="")) returned 1 [0206.379] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfb5376b0, ftCreationTime.dwHighDateTime=0x1d5e42d, ftLastAccessTime.dwLowDateTime=0xe4b3dc20, ftLastAccessTime.dwHighDateTime=0x1d5ddfb, ftLastWriteTime.dwLowDateTime=0xe4b3dc20, ftLastWriteTime.dwHighDateTime=0x1d5ddfb, nFileSizeHigh=0x0, nFileSizeLow=0x80fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="16ir0W3PE.flv", cAlternateFileName="16IR0W~1.FLV")) returned 1 [0206.379] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4ca4c330, ftCreationTime.dwHighDateTime=0x1d5dd0c, ftLastAccessTime.dwLowDateTime=0x812190b0, ftLastAccessTime.dwHighDateTime=0x1d5d9bb, ftLastWriteTime.dwLowDateTime=0x812190b0, ftLastWriteTime.dwHighDateTime=0x1d5d9bb, nFileSizeHigh=0x0, nFileSizeLow=0xaff3, dwReserved0=0x0, dwReserved1=0x0, cFileName="23C3.ots", cAlternateFileName="")) returned 1 [0206.379] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7b40820, ftCreationTime.dwHighDateTime=0x1d5e483, ftLastAccessTime.dwLowDateTime=0xf30ae810, ftLastAccessTime.dwHighDateTime=0x1d5e2f9, ftLastWriteTime.dwLowDateTime=0xf30ae810, ftLastWriteTime.dwHighDateTime=0x1d5e2f9, nFileSizeHigh=0x0, nFileSizeLow=0xa8a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="4UfsBSZgwq_rEH9BJsz.avi", cAlternateFileName="4UFSBS~1.AVI")) returned 1 [0206.379] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec55ee0, ftCreationTime.dwHighDateTime=0x1d5db20, ftLastAccessTime.dwLowDateTime=0x92c31c0, ftLastAccessTime.dwHighDateTime=0x1d5e0a3, ftLastWriteTime.dwLowDateTime=0x92c31c0, ftLastWriteTime.dwHighDateTime=0x1d5e0a3, nFileSizeHigh=0x0, nFileSizeLow=0x13c4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="6aHLmr0.rtf", cAlternateFileName="")) returned 1 [0206.379] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd01532b0, ftCreationTime.dwHighDateTime=0x1d5e4a3, ftLastAccessTime.dwLowDateTime=0xd42deaf0, ftLastAccessTime.dwHighDateTime=0x1d5e632, ftLastWriteTime.dwLowDateTime=0xd42deaf0, ftLastWriteTime.dwHighDateTime=0x1d5e632, nFileSizeHigh=0x0, nFileSizeLow=0xa233, dwReserved0=0x0, dwReserved1=0x0, cFileName="8Q6oB.png", cAlternateFileName="")) returned 1 [0206.379] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0206.380] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x489e50f0, ftCreationTime.dwHighDateTime=0x1d5df8f, ftLastAccessTime.dwLowDateTime=0xeb906350, ftLastAccessTime.dwHighDateTime=0x1d5e761, ftLastWriteTime.dwLowDateTime=0xeb906350, ftLastWriteTime.dwHighDateTime=0x1d5e761, nFileSizeHigh=0x0, nFileSizeLow=0xf53a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cdE0rN.mp4", cAlternateFileName="")) returned 1 [0206.380] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeaf4c9c0, ftCreationTime.dwHighDateTime=0x1d5e718, ftLastAccessTime.dwLowDateTime=0x6c8d7e30, ftLastAccessTime.dwHighDateTime=0x1d5df69, ftLastWriteTime.dwLowDateTime=0x6c8d7e30, ftLastWriteTime.dwHighDateTime=0x1d5df69, nFileSizeHigh=0x0, nFileSizeLow=0x9767, dwReserved0=0x0, dwReserved1=0x0, cFileName="dmxBPhcJ26 sk1R7xv-.mp4", cAlternateFileName="DMXBPH~1.MP4")) returned 1 [0206.380] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeeb843b0, ftCreationTime.dwHighDateTime=0x1d5db8e, ftLastAccessTime.dwLowDateTime=0xcc5e52a0, ftLastAccessTime.dwHighDateTime=0x1d5deb8, ftLastWriteTime.dwLowDateTime=0xcc5e52a0, ftLastWriteTime.dwHighDateTime=0x1d5deb8, nFileSizeHigh=0x0, nFileSizeLow=0x20a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="dSMq307rH.wav", cAlternateFileName="DSMQ30~1.WAV")) returned 1 [0206.380] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe0dca340, ftCreationTime.dwHighDateTime=0x1d5e15a, ftLastAccessTime.dwLowDateTime=0xf74d1cf0, ftLastAccessTime.dwHighDateTime=0x1d5e46a, ftLastWriteTime.dwLowDateTime=0xf74d1cf0, ftLastWriteTime.dwHighDateTime=0x1d5e46a, nFileSizeHigh=0x0, nFileSizeLow=0x52d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="E3D4tkHV9F-.mp3", cAlternateFileName="E3D4TK~1.MP3")) returned 1 [0206.380] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf64d0b50, ftCreationTime.dwHighDateTime=0x1d5da54, ftLastAccessTime.dwLowDateTime=0xc1887110, ftLastAccessTime.dwHighDateTime=0x1d5dbd1, ftLastWriteTime.dwLowDateTime=0xc1887110, ftLastWriteTime.dwHighDateTime=0x1d5dbd1, nFileSizeHigh=0x0, nFileSizeLow=0xc4be, dwReserved0=0x0, dwReserved1=0x0, cFileName="f0fPchxyWqYhh3CqHuV.mp3", cAlternateFileName="F0FPCH~1.MP3")) returned 1 [0206.380] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2b053dc0, ftCreationTime.dwHighDateTime=0x1d5e4f2, ftLastAccessTime.dwLowDateTime=0x2ec48200, ftLastAccessTime.dwHighDateTime=0x1d5e429, ftLastWriteTime.dwLowDateTime=0x2ec48200, ftLastWriteTime.dwHighDateTime=0x1d5e429, nFileSizeHigh=0x0, nFileSizeLow=0x130b, dwReserved0=0x0, dwReserved1=0x0, cFileName="F4XXp.gif", cAlternateFileName="")) returned 1 [0206.381] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c438ac0, ftCreationTime.dwHighDateTime=0x1d5d952, ftLastAccessTime.dwLowDateTime=0x57039000, ftLastAccessTime.dwHighDateTime=0x1d5e314, ftLastWriteTime.dwLowDateTime=0x57039000, ftLastWriteTime.dwHighDateTime=0x1d5e314, nFileSizeHigh=0x0, nFileSizeLow=0x1379, dwReserved0=0x0, dwReserved1=0x0, cFileName="gCSYz1.bmp", cAlternateFileName="")) returned 1 [0206.381] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x57894c50, ftCreationTime.dwHighDateTime=0x1d5dde6, ftLastAccessTime.dwLowDateTime=0xa6922000, ftLastAccessTime.dwHighDateTime=0x1d5d7e3, ftLastWriteTime.dwLowDateTime=0xa6922000, ftLastWriteTime.dwHighDateTime=0x1d5d7e3, nFileSizeHigh=0x0, nFileSizeLow=0x180bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMitpSx16W0MWC.mp4", cAlternateFileName="GMITPS~1.MP4")) returned 1 [0206.381] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Identities", cAlternateFileName="IDENTI~1")) returned 1 [0206.381] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda9854c0, ftCreationTime.dwHighDateTime=0x1d5e376, ftLastAccessTime.dwLowDateTime=0x3c4d06f0, ftLastAccessTime.dwHighDateTime=0x1d5dbcc, ftLastWriteTime.dwLowDateTime=0x3c4d06f0, ftLastWriteTime.dwHighDateTime=0x1d5dbcc, nFileSizeHigh=0x0, nFileSizeLow=0xf759, dwReserved0=0x0, dwReserved1=0x0, cFileName="LK3wet.m4a", cAlternateFileName="")) returned 1 [0206.381] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6b695060, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6b695060, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Macromedia", cAlternateFileName="MACROM~1")) returned 1 [0206.381] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf1d39b50, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf1d39b50, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0206.381] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0206.382] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x699b2d70, ftCreationTime.dwHighDateTime=0x1d5e05f, ftLastAccessTime.dwLowDateTime=0xc1379670, ftLastAccessTime.dwHighDateTime=0x1d5e1ba, ftLastWriteTime.dwLowDateTime=0xc1379670, ftLastWriteTime.dwHighDateTime=0x1d5e1ba, nFileSizeHigh=0x0, nFileSizeLow=0x9ab3, dwReserved0=0x0, dwReserved1=0x0, cFileName="mvHg.mp3", cAlternateFileName="")) returned 1 [0206.382] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x299870a0, ftCreationTime.dwHighDateTime=0x1d5d968, ftLastAccessTime.dwLowDateTime=0xd1fa4990, ftLastAccessTime.dwHighDateTime=0x1d5e718, ftLastWriteTime.dwLowDateTime=0xd1fa4990, ftLastWriteTime.dwHighDateTime=0x1d5e718, nFileSizeHigh=0x0, nFileSizeLow=0xb078, dwReserved0=0x0, dwReserved1=0x0, cFileName="NJ9gpMuFobkuakE09It.avi", cAlternateFileName="NJ9GPM~1.AVI")) returned 1 [0206.382] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd0f2bd70, ftCreationTime.dwHighDateTime=0x1d5e25e, ftLastAccessTime.dwLowDateTime=0xdf91a370, ftLastAccessTime.dwHighDateTime=0x1d5e25c, ftLastWriteTime.dwLowDateTime=0xdf91a370, ftLastWriteTime.dwHighDateTime=0x1d5e25c, nFileSizeHigh=0x0, nFileSizeLow=0x13350, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODQ1iLw.jpg", cAlternateFileName="")) returned 1 [0206.382] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33d7f8f0, ftCreationTime.dwHighDateTime=0x1d5e2ce, ftLastAccessTime.dwLowDateTime=0xf7ff3bf0, ftLastAccessTime.dwHighDateTime=0x1d5e317, ftLastWriteTime.dwLowDateTime=0xf7ff3bf0, ftLastWriteTime.dwHighDateTime=0x1d5e317, nFileSizeHigh=0x0, nFileSizeLow=0x5b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PoRrBFo7S4.doc", cAlternateFileName="PORRBF~1.DOC")) returned 1 [0206.382] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdd9d4450, ftCreationTime.dwHighDateTime=0x1d5e50b, ftLastAccessTime.dwLowDateTime=0x141bf550, ftLastAccessTime.dwHighDateTime=0x1d5e479, ftLastWriteTime.dwLowDateTime=0x141bf550, ftLastWriteTime.dwHighDateTime=0x1d5e479, nFileSizeHigh=0x0, nFileSizeLow=0x14b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="RyW9ICciPugByoH-biho.png", cAlternateFileName="RYW9IC~1.PNG")) returned 1 [0206.383] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1962d160, ftCreationTime.dwHighDateTime=0x1d5e789, ftLastAccessTime.dwLowDateTime=0x6ba73f20, ftLastAccessTime.dwHighDateTime=0x1d5e125, ftLastWriteTime.dwLowDateTime=0x6ba73f20, ftLastWriteTime.dwHighDateTime=0x1d5e125, nFileSizeHigh=0x0, nFileSizeLow=0xe56f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SfbpHAV.docx", cAlternateFileName="SFBPHA~1.DOC")) returned 1 [0206.383] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe5c52a0, ftCreationTime.dwHighDateTime=0x1d5d85c, ftLastAccessTime.dwLowDateTime=0xef5b4040, ftLastAccessTime.dwHighDateTime=0x1d5e27a, ftLastWriteTime.dwLowDateTime=0xef5b4040, ftLastWriteTime.dwHighDateTime=0x1d5e27a, nFileSizeHigh=0x0, nFileSizeLow=0x1643a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vdui2 HGg.jpg", cAlternateFileName="VDUI2H~1.JPG")) returned 1 [0206.383] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5cc1adf0, ftCreationTime.dwHighDateTime=0x1d5d839, ftLastAccessTime.dwLowDateTime=0x2169cb90, ftLastAccessTime.dwHighDateTime=0x1d5e7eb, ftLastWriteTime.dwLowDateTime=0x2169cb90, ftLastWriteTime.dwHighDateTime=0x1d5e7eb, nFileSizeHigh=0x0, nFileSizeLow=0x1275f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wy6pO.m4a", cAlternateFileName="")) returned 1 [0206.383] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2c0adc30, ftCreationTime.dwHighDateTime=0x1d5e037, ftLastAccessTime.dwLowDateTime=0x4ad97570, ftLastAccessTime.dwHighDateTime=0x1d5dff3, ftLastWriteTime.dwLowDateTime=0x4ad97570, ftLastWriteTime.dwHighDateTime=0x1d5dff3, nFileSizeHigh=0x0, nFileSizeLow=0x17bbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="XtsMhLVrcZoTKLkDHP.m4a", cAlternateFileName="XTSMHL~1.M4A")) returned 1 [0206.383] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x740d360, ftCreationTime.dwHighDateTime=0x1d5e01d, ftLastAccessTime.dwLowDateTime=0x73661020, ftLastAccessTime.dwHighDateTime=0x1d5e421, ftLastWriteTime.dwLowDateTime=0x73661020, ftLastWriteTime.dwHighDateTime=0x1d5e421, nFileSizeHigh=0x0, nFileSizeLow=0x4f84, dwReserved0=0x0, dwReserved1=0x0, cFileName="Y-VKjXOx.doc", cAlternateFileName="")) returned 1 [0206.384] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1f4a1340, ftCreationTime.dwHighDateTime=0x1d5e3e2, ftLastAccessTime.dwLowDateTime=0x8eab6c70, ftLastAccessTime.dwHighDateTime=0x1d5e239, ftLastWriteTime.dwLowDateTime=0x8eab6c70, ftLastWriteTime.dwHighDateTime=0x1d5e239, nFileSizeHigh=0x0, nFileSizeLow=0x18167, dwReserved0=0x0, dwReserved1=0x0, cFileName="zrDhI4xcrfpqVvnx.mp4", cAlternateFileName="ZRDHI4~1.MP4")) returned 1 [0206.384] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x23fe8d80, ftCreationTime.dwHighDateTime=0x1d5dea6, ftLastAccessTime.dwLowDateTime=0x71d6efd0, ftLastAccessTime.dwHighDateTime=0x1d5dc7a, ftLastWriteTime.dwLowDateTime=0x71d6efd0, ftLastWriteTime.dwHighDateTime=0x1d5dc7a, nFileSizeHigh=0x0, nFileSizeLow=0x16d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="zZ7gznI5PGJn1XryG1r.png", cAlternateFileName="ZZ7GZN~1.PNG")) returned 1 [0206.384] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec88ad00, ftCreationTime.dwHighDateTime=0x1d5dd50, ftLastAccessTime.dwLowDateTime=0x3c85f180, ftLastAccessTime.dwHighDateTime=0x1d5d8bc, ftLastWriteTime.dwLowDateTime=0x3c85f180, ftLastWriteTime.dwHighDateTime=0x1d5d8bc, nFileSizeHigh=0x0, nFileSizeLow=0xa81, dwReserved0=0x0, dwReserved1=0x0, cFileName="_biJoTEC5Y5Q5EtbDeK.mkv", cAlternateFileName="_BIJOT~1.MKV")) returned 1 [0206.384] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec30 | out: lpFindFileData=0x6a6ec30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec88ad00, ftCreationTime.dwHighDateTime=0x1d5dd50, ftLastAccessTime.dwLowDateTime=0x3c85f180, ftLastAccessTime.dwHighDateTime=0x1d5d8bc, ftLastWriteTime.dwLowDateTime=0x3c85f180, ftLastWriteTime.dwHighDateTime=0x1d5d8bc, nFileSizeHigh=0x0, nFileSizeLow=0xa81, dwReserved0=0x0, dwReserved1=0x0, cFileName="_biJoTEC5Y5Q5EtbDeK.mkv", cAlternateFileName="_BIJOT~1.MKV")) returned 0 [0206.384] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6eeb8) returned 1 [0206.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6eec4) returned 1 [0206.385] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe", nBufferLength=0x105, lpBuffer=0x6a6ea20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe", lpFilePart=0x0) returned 0x33 [0206.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eee8) returned 1 [0206.385] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe", nBufferLength=0x105, lpBuffer=0x6a6e9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe", lpFilePart=0x0) returned 0x33 [0206.385] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\", nBufferLength=0x105, lpBuffer=0x6a6e9c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\", lpFilePart=0x0) returned 0x34 [0206.385] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\*", lpFindFileData=0x6a6ec10 | out: lpFindFileData=0x6a6ec10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.443] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.443] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0206.444] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 1 [0206.444] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Headlights", cAlternateFileName="HEADLI~1")) returned 1 [0206.444] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 1 [0206.444] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LogTransport2", cAlternateFileName="LOGTRA~1")) returned 1 [0206.444] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LogTransport2", cAlternateFileName="LOGTRA~1")) returned 0 [0206.444] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6eea8) returned 1 [0206.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6eeb4) returned 1 [0206.445] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\.", nBufferLength=0x105, lpBuffer=0x6a6e9a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe", lpFilePart=0x0) returned 0x33 [0206.445] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee88) returned 1 [0206.445] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe", nBufferLength=0x105, lpBuffer=0x6a6e990, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe", lpFilePart=0x0) returned 0x33 [0206.445] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\", nBufferLength=0x105, lpBuffer=0x6a6e964, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\", lpFilePart=0x0) returned 0x34 [0206.445] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\*", lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.446] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.447] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0206.447] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 1 [0206.447] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Headlights", cAlternateFileName="HEADLI~1")) returned 1 [0206.447] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 1 [0206.447] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LogTransport2", cAlternateFileName="LOGTRA~1")) returned 1 [0206.447] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0206.447] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee48) returned 1 [0206.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee54) returned 1 [0206.448] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x3b [0206.448] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0206.448] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x3b [0206.448] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x3c [0206.449] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.450] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.450] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0206.450] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 0 [0206.450] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0206.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0206.450] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x3b [0206.450] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0206.450] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x3b [0206.450] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x3c [0206.451] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.451] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.451] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0206.451] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0206.451] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0206.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0206.451] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x40 [0206.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0206.451] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x40 [0206.451] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\", lpFilePart=0x0) returned 0x41 [0206.452] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.453] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.453] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Collab", cAlternateFileName="")) returned 1 [0206.453] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Forms", cAlternateFileName="")) returned 1 [0206.453] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JavaScripts", cAlternateFileName="JAVASC~1")) returned 1 [0206.453] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security", cAlternateFileName="")) returned 1 [0206.454] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security", cAlternateFileName="")) returned 0 [0206.454] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0206.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0206.454] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x40 [0206.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0206.454] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x40 [0206.454] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\", lpFilePart=0x0) returned 0x41 [0206.454] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.454] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.455] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Collab", cAlternateFileName="")) returned 1 [0206.455] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Forms", cAlternateFileName="")) returned 1 [0206.455] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JavaScripts", cAlternateFileName="JAVASC~1")) returned 1 [0206.455] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security", cAlternateFileName="")) returned 1 [0206.455] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0206.455] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0206.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0206.455] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab", lpFilePart=0x0) returned 0x47 [0206.455] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0206.455] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab", lpFilePart=0x0) returned 0x47 [0206.456] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\", lpFilePart=0x0) returned 0x48 [0206.456] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.457] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.457] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0206.458] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0206.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0206.458] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab", lpFilePart=0x0) returned 0x47 [0206.458] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms", lpFilePart=0x0) returned 0x46 [0206.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0206.458] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms", lpFilePart=0x0) returned 0x46 [0206.458] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\", lpFilePart=0x0) returned 0x47 [0206.458] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.458] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.459] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0206.459] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0206.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0206.459] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms", lpFilePart=0x0) returned 0x46 [0206.459] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts", lpFilePart=0x0) returned 0x4c [0206.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0206.459] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts", lpFilePart=0x0) returned 0x4c [0206.459] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\", lpFilePart=0x0) returned 0x4d [0206.459] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.460] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.460] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xedc00b50, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="glob.js", cAlternateFileName="")) returned 1 [0206.460] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xedc00b50, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x0, dwReserved1=0x0, cFileName="glob.settings.js", cAlternateFileName="GLOBSE~1.JS")) returned 1 [0206.461] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0206.461] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0206.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0206.461] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts", lpFilePart=0x0) returned 0x4c [0206.461] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security", lpFilePart=0x0) returned 0x49 [0206.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0206.461] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security", lpFilePart=0x0) returned 0x49 [0206.461] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\", lpFilePart=0x0) returned 0x4a [0206.461] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.462] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.462] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda8cdc00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8f3d60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x1517, dwReserved0=0x0, dwReserved1=0x0, cFileName="addressbook.acrodata", cAlternateFileName="ADDRES~1.ACR")) returned 1 [0206.462] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda2b43a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda5adf20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRLCache", cAlternateFileName="")) returned 1 [0206.462] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda2b43a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda5adf20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRLCache", cAlternateFileName="")) returned 0 [0206.462] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0206.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0206.462] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security", lpFilePart=0x0) returned 0x49 [0206.462] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player", lpFilePart=0x0) returned 0x40 [0206.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0206.463] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player", lpFilePart=0x0) returned 0x40 [0206.463] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\", lpFilePart=0x0) returned 0x41 [0206.463] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.464] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.464] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssetCache", cAlternateFileName="ASSETC~1")) returned 1 [0206.464] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssetCache", cAlternateFileName="ASSETC~1")) returned 0 [0206.464] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0206.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0206.465] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player", lpFilePart=0x0) returned 0x40 [0206.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0206.465] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player", lpFilePart=0x0) returned 0x40 [0206.465] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\", lpFilePart=0x0) returned 0x41 [0206.465] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.465] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.466] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssetCache", cAlternateFileName="ASSETC~1")) returned 1 [0206.466] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0206.466] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0206.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0206.466] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", lpFilePart=0x0) returned 0x4b [0206.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0206.466] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", lpFilePart=0x0) returned 0x4b [0206.466] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\", lpFilePart=0x0) returned 0x4c [0206.466] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.467] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.467] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="D5NTRC6R", cAlternateFileName="")) returned 1 [0206.467] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="D5NTRC6R", cAlternateFileName="")) returned 0 [0206.467] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0206.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0206.467] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", lpFilePart=0x0) returned 0x4b [0206.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0206.467] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", lpFilePart=0x0) returned 0x4b [0206.467] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\", lpFilePart=0x0) returned 0x4c [0206.467] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.468] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.468] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="D5NTRC6R", cAlternateFileName="")) returned 1 [0206.468] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0206.468] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0206.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0206.468] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R", lpFilePart=0x0) returned 0x54 [0206.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0206.468] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R", lpFilePart=0x0) returned 0x54 [0206.468] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\", lpFilePart=0x0) returned 0x55 [0206.468] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.493] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.494] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0206.494] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0206.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0206.494] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R", lpFilePart=0x0) returned 0x54 [0206.494] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights", lpFilePart=0x0) returned 0x3e [0206.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0206.494] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights", lpFilePart=0x0) returned 0x3e [0206.494] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\", lpFilePart=0x0) returned 0x3f [0206.494] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.495] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.495] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0206.495] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0206.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0206.495] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights", lpFilePart=0x0) returned 0x3e [0206.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0206.495] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights", lpFilePart=0x0) returned 0x3e [0206.495] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\", lpFilePart=0x0) returned 0x3f [0206.495] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.496] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.496] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0206.496] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0206.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0206.496] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics", lpFilePart=0x0) returned 0x3f [0206.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0206.496] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics", lpFilePart=0x0) returned 0x3f [0206.496] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\", lpFilePart=0x0) returned 0x40 [0206.496] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.497] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.497] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 1 [0206.497] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 0 [0206.497] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0206.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0206.497] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics", lpFilePart=0x0) returned 0x3f [0206.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0206.498] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics", lpFilePart=0x0) returned 0x3f [0206.498] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\", lpFilePart=0x0) returned 0x40 [0206.498] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.498] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.498] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 1 [0206.498] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0206.498] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0206.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0206.498] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries", lpFilePart=0x0) returned 0x4c [0206.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0206.498] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries", lpFilePart=0x0) returned 0x4c [0206.499] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\", lpFilePart=0x0) returned 0x4d [0206.499] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.499] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.499] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0206.499] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0206.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0206.499] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries", lpFilePart=0x0) returned 0x4c [0206.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0206.499] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries", lpFilePart=0x0) returned 0x4c [0206.499] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\", lpFilePart=0x0) returned 0x4d [0206.500] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.500] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.500] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0206.500] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0206.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0206.500] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2", lpFilePart=0x0) returned 0x41 [0206.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0206.500] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2", lpFilePart=0x0) returned 0x41 [0206.500] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\", lpFilePart=0x0) returned 0x42 [0206.500] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.501] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.501] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0206.501] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0206.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0206.501] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2", lpFilePart=0x0) returned 0x41 [0206.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0206.501] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2", lpFilePart=0x0) returned 0x41 [0206.501] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\", lpFilePart=0x0) returned 0x42 [0206.501] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.501] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.502] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0206.502] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0206.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0206.502] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities", nBufferLength=0x105, lpBuffer=0x6a6ea20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities", lpFilePart=0x0) returned 0x38 [0206.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eee8) returned 1 [0206.502] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities", nBufferLength=0x105, lpBuffer=0x6a6e9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities", lpFilePart=0x0) returned 0x38 [0206.502] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\", nBufferLength=0x105, lpBuffer=0x6a6e9c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\", lpFilePart=0x0) returned 0x39 [0206.502] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\*", lpFindFileData=0x6a6ec10 | out: lpFindFileData=0x6a6ec10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.502] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.502] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{31810C36-5D23-4CCE-A3B4-316DED195C38}", cAlternateFileName="{31810~1")) returned 1 [0206.503] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{31810C36-5D23-4CCE-A3B4-316DED195C38}", cAlternateFileName="{31810~1")) returned 0 [0206.503] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6eea8) returned 1 [0206.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6eeb4) returned 1 [0206.503] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\.", nBufferLength=0x105, lpBuffer=0x6a6e9a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities", lpFilePart=0x0) returned 0x38 [0206.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee88) returned 1 [0206.503] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities", nBufferLength=0x105, lpBuffer=0x6a6e990, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities", lpFilePart=0x0) returned 0x38 [0206.503] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\", nBufferLength=0x105, lpBuffer=0x6a6e964, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\", lpFilePart=0x0) returned 0x39 [0206.503] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\*", lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.503] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.503] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{31810C36-5D23-4CCE-A3B4-316DED195C38}", cAlternateFileName="{31810~1")) returned 1 [0206.504] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0206.504] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee48) returned 1 [0206.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee54) returned 1 [0206.504] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}", lpFilePart=0x0) returned 0x5f [0206.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0206.504] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}", lpFilePart=0x0) returned 0x5f [0206.504] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\", lpFilePart=0x0) returned 0x60 [0206.504] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.504] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.505] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0206.505] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0206.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0206.505] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}", lpFilePart=0x0) returned 0x5f [0206.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0206.505] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}", lpFilePart=0x0) returned 0x5f [0206.505] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\", lpFilePart=0x0) returned 0x60 [0206.505] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.505] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.505] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0206.506] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0206.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0206.506] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia", nBufferLength=0x105, lpBuffer=0x6a6ea20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia", lpFilePart=0x0) returned 0x38 [0206.506] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eee8) returned 1 [0206.506] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia", nBufferLength=0x105, lpBuffer=0x6a6e9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia", lpFilePart=0x0) returned 0x38 [0206.506] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\", nBufferLength=0x105, lpBuffer=0x6a6e9c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\", lpFilePart=0x0) returned 0x39 [0206.506] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\*", lpFindFileData=0x6a6ec10 | out: lpFindFileData=0x6a6ec10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6b695060, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6b695060, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.508] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6b695060, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6b695060, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.508] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 1 [0206.508] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 0 [0206.508] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6eea8) returned 1 [0206.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6eeb4) returned 1 [0206.508] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\.", nBufferLength=0x105, lpBuffer=0x6a6e9a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia", lpFilePart=0x0) returned 0x38 [0206.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee88) returned 1 [0206.508] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia", nBufferLength=0x105, lpBuffer=0x6a6e990, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia", lpFilePart=0x0) returned 0x38 [0206.508] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\", nBufferLength=0x105, lpBuffer=0x6a6e964, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\", lpFilePart=0x0) returned 0x39 [0206.508] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\*", lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6b695060, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6b695060, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.509] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6b695060, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6b695060, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.509] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 1 [0206.509] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0206.509] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee48) returned 1 [0206.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee54) returned 1 [0206.509] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player", lpFilePart=0x0) returned 0x45 [0206.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0206.509] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player", lpFilePart=0x0) returned 0x45 [0206.509] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\", lpFilePart=0x0) returned 0x46 [0206.509] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.510] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.510] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="#SharedObjects", cAlternateFileName="#SHARE~1")) returned 1 [0206.511] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="macromedia.com", cAlternateFileName="MACROM~1.COM")) returned 1 [0206.511] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="macromedia.com", cAlternateFileName="MACROM~1.COM")) returned 0 [0206.511] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.511] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0206.511] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0206.511] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player", lpFilePart=0x0) returned 0x45 [0206.511] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0206.511] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player", lpFilePart=0x0) returned 0x45 [0206.511] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\", lpFilePart=0x0) returned 0x46 [0206.511] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.512] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.512] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="#SharedObjects", cAlternateFileName="#SHARE~1")) returned 1 [0206.512] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="macromedia.com", cAlternateFileName="MACROM~1.COM")) returned 1 [0206.512] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0206.512] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0206.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0206.512] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects", lpFilePart=0x0) returned 0x54 [0206.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0206.512] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects", lpFilePart=0x0) returned 0x54 [0206.512] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\", lpFilePart=0x0) returned 0x55 [0206.513] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.517] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.517] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="P7Y3F7QB", cAlternateFileName="")) returned 1 [0206.517] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="P7Y3F7QB", cAlternateFileName="")) returned 0 [0206.517] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.517] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0206.517] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0206.517] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects", lpFilePart=0x0) returned 0x54 [0206.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0206.517] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects", lpFilePart=0x0) returned 0x54 [0206.517] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\", lpFilePart=0x0) returned 0x55 [0206.517] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.518] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.518] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="P7Y3F7QB", cAlternateFileName="")) returned 1 [0206.518] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0206.518] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0206.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0206.518] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB", lpFilePart=0x0) returned 0x5d [0206.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0206.518] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB", lpFilePart=0x0) returned 0x5d [0206.518] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\", lpFilePart=0x0) returned 0x5e [0206.518] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.559] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.559] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0206.559] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0206.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0206.559] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB", lpFilePart=0x0) returned 0x5d [0206.559] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", lpFilePart=0x0) returned 0x54 [0206.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0206.559] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", lpFilePart=0x0) returned 0x54 [0206.559] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\", lpFilePart=0x0) returned 0x55 [0206.560] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.606] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.606] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="support", cAlternateFileName="")) returned 1 [0206.606] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="support", cAlternateFileName="")) returned 0 [0206.606] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0206.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0206.606] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", lpFilePart=0x0) returned 0x54 [0206.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0206.606] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", lpFilePart=0x0) returned 0x54 [0206.606] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\", lpFilePart=0x0) returned 0x55 [0206.607] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.607] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.607] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="support", cAlternateFileName="")) returned 1 [0206.607] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0206.607] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0206.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0206.607] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", lpFilePart=0x0) returned 0x5c [0206.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0206.607] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", lpFilePart=0x0) returned 0x5c [0206.608] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\", lpFilePart=0x0) returned 0x5d [0206.608] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.838] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.838] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="flashplayer", cAlternateFileName="FLASHP~1")) returned 1 [0206.838] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="flashplayer", cAlternateFileName="FLASHP~1")) returned 0 [0206.838] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0206.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0206.839] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", lpFilePart=0x0) returned 0x5c [0206.839] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft", nBufferLength=0x105, lpBuffer=0x6a6ea20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft", lpFilePart=0x0) returned 0x37 [0206.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eee8) returned 1 [0206.839] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft", nBufferLength=0x105, lpBuffer=0x6a6e9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft", lpFilePart=0x0) returned 0x37 [0206.839] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x6a6e9c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", lpFilePart=0x0) returned 0x38 [0206.839] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*", lpFindFileData=0x6a6ec10 | out: lpFindFileData=0x6a6ec10*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf1d39b50, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf1d39b50, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.839] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf1d39b50, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf1d39b50, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.839] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c36290, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7c36290, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x7c36290, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddIns", cAlternateFileName="")) returned 1 [0206.839] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1 [0206.840] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crypto", cAlternateFileName="")) returned 1 [0206.840] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1d39b50, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf1d39b50, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0x40c99890, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x3b800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ctfmom.exe", cAlternateFileName="")) returned 1 [0206.840] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Document Building Blocks", cAlternateFileName="DOCUME~1")) returned 1 [0206.840] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c1e0470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Excel", cAlternateFileName="")) returned 1 [0206.840] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IME12", cAlternateFileName="")) returned 1 [0206.840] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMJP12", cAlternateFileName="")) returned 1 [0206.840] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMJP8_1", cAlternateFileName="")) returned 1 [0206.841] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMJP9_0", cAlternateFileName="")) returned 1 [0206.841] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0206.841] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f5d6350, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x2f5d6350, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x2f5d6350, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MMC", cAlternateFileName="")) returned 1 [0206.841] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS Project", cAlternateFileName="MSPROJ~1")) returned 1 [0206.841] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1 [0206.841] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43c8ae30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dae0390, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5dae0390, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1 [0206.841] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5c734300, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x6215c440, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6215c440, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook", cAlternateFileName="")) returned 1 [0206.841] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33c0ebb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x33c0ebb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x33c0ebb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPoint", cAlternateFileName="POWERP~1")) returned 1 [0206.842] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x510b16f0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x510b16f0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x510b16f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof", cAlternateFileName="")) returned 1 [0206.842] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x541f1c70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x541f1c70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Protect", cAlternateFileName="")) returned 1 [0206.842] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43bcc750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x43bcc750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x43bcc750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0206.842] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbec39d0, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher Building Blocks", cAlternateFileName="PUBLIS~2")) returned 1 [0206.842] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Speech", cAlternateFileName="")) returned 1 [0206.842] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemCertificates", cAlternateFileName="SYSTEM~1")) returned 1 [0206.842] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d42f10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2795d470, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x2795d470, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0206.842] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UProof", cAlternateFileName="")) returned 1 [0206.842] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0206.842] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f71aa70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word", cAlternateFileName="")) returned 1 [0206.842] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1d39b50, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf1d39b50, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0x40c4d5d0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x30, dwReserved0=0x0, dwReserved1=0x0, cFileName="_CL_02f3a8c9sy", cAlternateFileName="_CL_02~1")) returned 1 [0206.842] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ec20 | out: lpFindFileData=0x6a6ec20*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0206.842] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6eea8) returned 1 [0206.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6eeb4) returned 1 [0206.843] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\.", nBufferLength=0x105, lpBuffer=0x6a6e9a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft", lpFilePart=0x0) returned 0x37 [0206.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee88) returned 1 [0206.843] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft", nBufferLength=0x105, lpBuffer=0x6a6e990, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft", lpFilePart=0x0) returned 0x37 [0206.843] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x6a6e964, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", lpFilePart=0x0) returned 0x38 [0206.843] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*", lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf1d39b50, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf1d39b50, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.843] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf1d39b50, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0xf1d39b50, ftLastWriteTime.dwHighDateTime=0x1d69aea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.843] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c36290, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7c36290, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x7c36290, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddIns", cAlternateFileName="")) returned 1 [0206.843] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1 [0206.843] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crypto", cAlternateFileName="")) returned 1 [0206.843] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1d39b50, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf1d39b50, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0x40c99890, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x3b800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ctfmom.exe", cAlternateFileName="")) returned 1 [0206.843] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Document Building Blocks", cAlternateFileName="DOCUME~1")) returned 1 [0206.843] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c1e0470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Excel", cAlternateFileName="")) returned 1 [0206.843] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IME12", cAlternateFileName="")) returned 1 [0206.843] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMJP12", cAlternateFileName="")) returned 1 [0206.844] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMJP8_1", cAlternateFileName="")) returned 1 [0206.844] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMJP9_0", cAlternateFileName="")) returned 1 [0206.844] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0206.844] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f5d6350, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x2f5d6350, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x2f5d6350, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MMC", cAlternateFileName="")) returned 1 [0206.844] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS Project", cAlternateFileName="MSPROJ~1")) returned 1 [0206.844] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1 [0206.844] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43c8ae30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dae0390, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5dae0390, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1 [0206.844] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5c734300, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x6215c440, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6215c440, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook", cAlternateFileName="")) returned 1 [0206.844] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33c0ebb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x33c0ebb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x33c0ebb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPoint", cAlternateFileName="POWERP~1")) returned 1 [0206.844] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x510b16f0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x510b16f0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x510b16f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof", cAlternateFileName="")) returned 1 [0206.844] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x541f1c70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x541f1c70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Protect", cAlternateFileName="")) returned 1 [0206.844] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43bcc750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x43bcc750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x43bcc750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0206.844] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbec39d0, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher Building Blocks", cAlternateFileName="PUBLIS~2")) returned 1 [0206.844] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Speech", cAlternateFileName="")) returned 1 [0206.844] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemCertificates", cAlternateFileName="SYSTEM~1")) returned 1 [0206.844] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d42f10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2795d470, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x2795d470, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0206.844] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UProof", cAlternateFileName="")) returned 1 [0206.844] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0206.844] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f71aa70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word", cAlternateFileName="")) returned 1 [0206.844] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1d39b50, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf1d39b50, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0x40c4d5d0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x30, dwReserved0=0x0, dwReserved1=0x0, cFileName="_CL_02f3a8c9sy", cAlternateFileName="_CL_02~1")) returned 1 [0206.844] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebc0 | out: lpFindFileData=0x6a6ebc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1d39b50, ftCreationTime.dwHighDateTime=0x1d69aea, ftLastAccessTime.dwLowDateTime=0xf1d39b50, ftLastAccessTime.dwHighDateTime=0x1d69aea, ftLastWriteTime.dwLowDateTime=0x40c4d5d0, ftLastWriteTime.dwHighDateTime=0x1d69aeb, nFileSizeHigh=0x0, nFileSizeLow=0x30, dwReserved0=0x0, dwReserved1=0x0, cFileName="_CL_02f3a8c9sy", cAlternateFileName="_CL_02~1")) returned 0 [0206.845] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee48) returned 1 [0206.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee54) returned 1 [0206.845] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns", lpFilePart=0x0) returned 0x3e [0206.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0206.845] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns", lpFilePart=0x0) returned 0x3e [0206.845] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\", lpFilePart=0x0) returned 0x3f [0206.845] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c36290, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7c36290, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x7c36290, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.871] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c36290, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7c36290, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x7c36290, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.871] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c36290, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7c36290, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x7c36290, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0206.871] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0206.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0206.871] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns", lpFilePart=0x0) returned 0x3e [0206.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0206.871] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns", lpFilePart=0x0) returned 0x3e [0206.871] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\", lpFilePart=0x0) returned 0x3f [0206.871] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c36290, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7c36290, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x7c36290, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.871] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c36290, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7c36290, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x7c36290, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.871] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c36290, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7c36290, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x7c36290, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0206.872] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0206.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0206.872] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x43 [0206.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0206.872] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x43 [0206.872] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x44 [0206.872] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.872] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.872] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0206.872] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0206.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0206.872] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x43 [0206.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0206.872] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x43 [0206.872] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x44 [0206.872] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.873] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.873] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0206.873] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0206.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0206.873] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x3e [0206.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0206.873] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x3e [0206.873] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\", lpFilePart=0x0) returned 0x3f [0206.873] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.873] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.873] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 1 [0206.873] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 0 [0206.874] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0206.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0206.874] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x3e [0206.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0206.874] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x3e [0206.874] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\", lpFilePart=0x0) returned 0x3f [0206.874] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.874] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.874] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 1 [0206.874] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0206.874] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0206.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0206.874] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x42 [0206.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0206.874] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x42 [0206.874] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\", lpFilePart=0x0) returned 0x43 [0206.875] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.875] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.875] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0206.875] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0206.875] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0206.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0206.875] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x42 [0206.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0206.875] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x42 [0206.875] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\", lpFilePart=0x0) returned 0x43 [0206.875] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.875] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.876] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0206.876] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eae0 | out: lpFindFileData=0x6a6eae0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0206.876] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0206.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0206.876] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000", lpFilePart=0x0) returned 0x71 [0206.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0206.876] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000", lpFilePart=0x0) returned 0x71 [0206.876] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpFilePart=0x0) returned 0x72 [0206.876] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.887] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.887] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xa1e34990, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="83AA4C~1")) returned 1 [0206.887] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x57, dwReserved0=0x0, dwReserved1=0x0, cFileName="932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="932A2D~1")) returned 1 [0206.887] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xb0aa1fc0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0aa1fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0aa1fc0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="FDA992~1")) returned 1 [0206.887] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0206.887] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0206.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0206.888] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000", lpFilePart=0x0) returned 0x71 [0206.888] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks", lpFilePart=0x0) returned 0x50 [0206.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0206.888] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks", lpFilePart=0x0) returned 0x50 [0206.888] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\", lpFilePart=0x0) returned 0x51 [0206.889] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.889] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.889] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0206.889] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6ebb0 | out: lpFindFileData=0x6a6ebb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0206.889] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0206.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0206.889] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks", lpFilePart=0x0) returned 0x50 [0206.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0206.889] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks", lpFilePart=0x0) returned 0x50 [0206.889] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\", lpFilePart=0x0) returned 0x51 [0206.889] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.890] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.890] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0206.890] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb50 | out: lpFindFileData=0x6a6eb50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0206.890] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0206.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0206.890] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", lpFilePart=0x0) returned 0x55 [0206.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0206.890] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", lpFilePart=0x0) returned 0x55 [0206.890] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\", lpFilePart=0x0) returned 0x56 [0206.890] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.891] FindNextFileW (in: hFindFile=0x9804e0, lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.891] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0206.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0206.891] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", lpFilePart=0x0) returned 0x55 [0206.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0206.891] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", lpFilePart=0x0) returned 0x55 [0206.891] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\", lpFilePart=0x0) returned 0x56 [0206.891] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.892] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0206.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0206.892] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14", lpFilePart=0x0) returned 0x58 [0206.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0206.892] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14", lpFilePart=0x0) returned 0x58 [0206.892] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\", lpFilePart=0x0) returned 0x59 [0206.892] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.893] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0206.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0206.893] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14", lpFilePart=0x0) returned 0x58 [0206.893] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel", lpFilePart=0x0) returned 0x3d [0206.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0206.893] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel", lpFilePart=0x0) returned 0x3d [0206.893] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\", lpFilePart=0x0) returned 0x3e [0206.893] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c1e0470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.893] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0206.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0206.894] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel", lpFilePart=0x0) returned 0x3d [0206.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0206.894] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel", lpFilePart=0x0) returned 0x3d [0206.894] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\", lpFilePart=0x0) returned 0x3e [0206.894] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c1e0470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.894] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0206.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0206.894] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", lpFilePart=0x0) returned 0x45 [0206.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0206.894] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", lpFilePart=0x0) returned 0x45 [0206.894] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\", lpFilePart=0x0) returned 0x46 [0206.894] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.895] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0206.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0206.895] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", lpFilePart=0x0) returned 0x45 [0206.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0206.895] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", lpFilePart=0x0) returned 0x45 [0206.895] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\", lpFilePart=0x0) returned 0x46 [0206.895] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.895] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0206.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0206.895] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12", lpFilePart=0x0) returned 0x3d [0206.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0206.895] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12", lpFilePart=0x0) returned 0x3d [0206.895] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12\\", lpFilePart=0x0) returned 0x3e [0206.895] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.896] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0206.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0206.896] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12", lpFilePart=0x0) returned 0x3d [0206.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0206.896] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12", lpFilePart=0x0) returned 0x3d [0206.896] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12\\", lpFilePart=0x0) returned 0x3e [0206.896] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.896] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0206.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0206.896] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12", lpFilePart=0x0) returned 0x3e [0206.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0206.896] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12", lpFilePart=0x0) returned 0x3e [0206.896] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12\\", lpFilePart=0x0) returned 0x3f [0206.897] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.897] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0206.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0206.898] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12", lpFilePart=0x0) returned 0x3e [0206.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0206.898] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12", lpFilePart=0x0) returned 0x3e [0206.899] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12\\", lpFilePart=0x0) returned 0x3f [0206.899] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.899] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0206.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0206.899] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1", lpFilePart=0x0) returned 0x3f [0206.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0206.899] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1", lpFilePart=0x0) returned 0x3f [0206.899] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1\\", lpFilePart=0x0) returned 0x40 [0206.899] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.899] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0206.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0206.899] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1", lpFilePart=0x0) returned 0x3f [0206.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0206.900] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1", lpFilePart=0x0) returned 0x3f [0206.900] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1\\", lpFilePart=0x0) returned 0x40 [0206.900] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.900] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0206.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0206.900] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0", lpFilePart=0x0) returned 0x3f [0206.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0206.900] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0", lpFilePart=0x0) returned 0x3f [0206.900] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0\\", lpFilePart=0x0) returned 0x40 [0206.900] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.900] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0206.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0206.900] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0", lpFilePart=0x0) returned 0x3f [0206.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0206.901] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0", lpFilePart=0x0) returned 0x3f [0206.901] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0\\", lpFilePart=0x0) returned 0x40 [0206.901] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.901] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0206.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0206.901] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x49 [0206.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0206.901] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x49 [0206.901] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", lpFilePart=0x0) returned 0x4a [0206.901] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.901] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0206.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0206.901] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x49 [0206.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0206.902] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x49 [0206.902] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", lpFilePart=0x0) returned 0x4a [0206.902] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.902] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0206.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0206.902] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", lpFilePart=0x0) returned 0x56 [0206.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0206.902] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", lpFilePart=0x0) returned 0x56 [0206.902] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpFilePart=0x0) returned 0x57 [0206.902] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbda554a0, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0xbda554a0, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.902] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0206.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0206.902] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", lpFilePart=0x0) returned 0x56 [0206.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0206.903] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", lpFilePart=0x0) returned 0x56 [0206.903] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpFilePart=0x0) returned 0x57 [0206.903] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbda554a0, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0xbda554a0, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.903] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0206.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0206.903] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", lpFilePart=0x0) returned 0x62 [0206.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0206.903] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", lpFilePart=0x0) returned 0x62 [0206.903] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", lpFilePart=0x0) returned 0x63 [0206.903] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x119ccee, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.903] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0206.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0206.903] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", lpFilePart=0x0) returned 0x62 [0206.903] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData", nBufferLength=0x105, lpBuffer=0x6a6e940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData", lpFilePart=0x0) returned 0x52 [0206.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0206.904] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData", nBufferLength=0x105, lpBuffer=0x6a6e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData", lpFilePart=0x0) returned 0x52 [0206.904] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\", nBufferLength=0x105, lpBuffer=0x6a6e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\", lpFilePart=0x0) returned 0x53 [0206.904] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\*", lpFindFileData=0x6a6eb30 | out: lpFindFileData=0x6a6eb30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.905] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0206.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0206.905] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\.", nBufferLength=0x105, lpBuffer=0x6a6e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData", lpFilePart=0x0) returned 0x52 [0206.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0206.905] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData", nBufferLength=0x105, lpBuffer=0x6a6e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData", lpFilePart=0x0) returned 0x52 [0206.905] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\", nBufferLength=0x105, lpBuffer=0x6a6e884, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\", lpFilePart=0x0) returned 0x53 [0206.905] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\*", lpFindFileData=0x6a6ead0 | out: lpFindFileData=0x6a6ead0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.905] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0206.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0206.905] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low", lpFilePart=0x0) returned 0x56 [0206.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0206.905] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low", nBufferLength=0x105, lpBuffer=0x6a6e8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low", lpFilePart=0x0) returned 0x56 [0206.905] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\", nBufferLength=0x105, lpBuffer=0x6a6e874, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\", lpFilePart=0x0) returned 0x57 [0206.905] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*", lpFindFileData=0x6a6eac0 | out: lpFindFileData=0x6a6eac0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.906] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0206.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0206.906] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\.", nBufferLength=0x105, lpBuffer=0x6a6e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low", lpFilePart=0x0) returned 0x56 [0206.906] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC", lpFilePart=0x0) returned 0x3b [0206.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0206.906] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC", lpFilePart=0x0) returned 0x3b [0206.906] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\", lpFilePart=0x0) returned 0x3c [0206.906] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f5d6350, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x2f5d6350, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x2f5d6350, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.907] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0206.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0206.907] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC", lpFilePart=0x0) returned 0x3b [0206.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0206.907] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC", lpFilePart=0x0) returned 0x3b [0206.907] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\", nBufferLength=0x105, lpBuffer=0x6a6e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\", lpFilePart=0x0) returned 0x3c [0206.907] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\*", lpFindFileData=0x6a6eb40 | out: lpFindFileData=0x6a6eb40*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f5d6350, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x2f5d6350, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x2f5d6350, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.907] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0206.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0206.908] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project", nBufferLength=0x105, lpBuffer=0x6a6e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project", lpFilePart=0x0) returned 0x42 [0206.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee78) returned 1 [0206.908] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project", nBufferLength=0x105, lpBuffer=0x6a6e980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project", lpFilePart=0x0) returned 0x42 [0206.908] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\", nBufferLength=0x105, lpBuffer=0x6a6e954, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\", lpFilePart=0x0) returned 0x43 [0206.908] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\*", lpFindFileData=0x6a6eba0 | out: lpFindFileData=0x6a6eba0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9804e0 [0206.909] FindClose (in: hFindFile=0x9804e0 | out: hFindFile=0x9804e0) returned 1 [0206.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee38) returned 1 [0206.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee44) returned 1 [0206.909] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\.", nBufferLength=0x105, lpBuffer=0x6a6e938, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project", lpFilePart=0x0) returned 0x42 [0206.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee18) returned 1 [0206.909] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project", nBufferLength=0x105, lpBuffer=0x6a6e920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project", lpFilePart=0x0) returned 0x42 [0206.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd8) returned 1 [0206.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ede4) returned 1 [0206.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee08) returned 1 [0206.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc8) returned 1 [0206.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edd4) returned 1 [0206.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eda8) returned 1 [0206.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed68) returned 1 [0206.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed74) returned 1 [0206.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ed98) returned 1 [0206.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed58) returned 1 [0206.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ed64) returned 1 [0207.031] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\key3.db", nBufferLength=0x105, lpBuffer=0x6a6ea64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\key3.db", lpFilePart=0x0) returned 0x5f [0207.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6eec4) returned 1 [0207.031] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\key3.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\key3.db"), fInfoLevelId=0x0, lpFileInformation=0x6a6ef40 | out: lpFileInformation=0x6a6ef40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4815eb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb4815eb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x853f60d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0207.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6eec0) returned 1 [0207.042] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\key3.db", nBufferLength=0x105, lpBuffer=0x6a6ea14, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\key3.db", lpFilePart=0x0) returned 0x5f [0207.042] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\tempDataBase2020-10-05T18_43_56.1430000+11_0088", nBufferLength=0x105, lpBuffer=0x6a6ea14, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\tempDataBase2020-10-05T18_43_56.1430000+11_0088", lpFilePart=0x0) returned 0x60 [0207.042] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\key3.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\key3.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\tempDataBase2020-10-05T18_43_56.1430000+11_0088" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\tempdatabase2020-10-05t18_43_56.1430000+11_0088"), bFailIfExists=0) returned 1 [0208.373] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x9bc6d0 [0208.502] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\tempDataBase2020-10-05T18_43_56.1430000+11_0088", nBufferLength=0x105, lpBuffer=0x6a6ea04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\tempDataBase2020-10-05T18_43_56.1430000+11_0088", lpFilePart=0x0) returned 0x60 [0208.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ee64) returned 1 [0208.502] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\tempDataBase2020-10-05T18_43_56.1430000+11_0088" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\tempdatabase2020-10-05t18_43_56.1430000+11_0088"), fInfoLevelId=0x0, lpFileInformation=0x6a6eee0 | out: lpFileInformation=0x6a6eee0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x47803950, ftCreationTime.dwHighDateTime=0x1d69aeb, ftLastAccessTime.dwLowDateTime=0x47803950, ftLastAccessTime.dwHighDateTime=0x1d69aeb, ftLastWriteTime.dwLowDateTime=0x853f60d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0208.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ee60) returned 1 [0208.528] GetCurrentProcessId () returned 0x460 [0208.530] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll", nBufferLength=0x105, lpBuffer=0x6a6e268, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll", lpFilePart=0x0) returned 0x63 [0208.530] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll", nBufferLength=0x105, lpBuffer=0x6a6e1e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll", lpFilePart=0x0) returned 0x63 [0208.535] CoTaskMemAlloc (cb=0x34) returned 0x9e4a60 [0208.535] CoTaskMemAlloc (cb=0xc8) returned 0xa1e640 [0208.535] CoTaskMemFree (pv=0x9e4a60) [0208.535] CoTaskMemFree (pv=0xa1e640) [0208.762] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\tempDataBase2020-10-05T18_43_56.1430000+11_0088", nBufferLength=0x105, lpBuffer=0x6a6e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\tempDataBase2020-10-05T18_43_56.1430000+11_0088", lpFilePart=0x0) returned 0x60 [0208.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6edc4) returned 1 [0208.762] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\tempDataBase2020-10-05T18_43_56.1430000+11_0088" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\tempdatabase2020-10-05t18_43_56.1430000+11_0088"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x284 [0208.762] GetFileType (hFile=0x284) returned 0x1 [0208.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6edc0) returned 1 [0208.762] GetFileType (hFile=0x284) returned 0x1 [0208.763] GetFileSize (in: hFile=0x284, lpFileSizeHigh=0x6a6eeb4 | out: lpFileSizeHigh=0x6a6eeb4*=0x0) returned 0x4000 [0208.763] ReadFile (in: hFile=0x284, lpBuffer=0x25ff228, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x6a6ee68, lpOverlapped=0x0 | out: lpBuffer=0x25ff228*, lpNumberOfBytesRead=0x6a6ee68*=0x1000, lpOverlapped=0x0) returned 1 [0208.763] ReadFile (in: hFile=0x284, lpBuffer=0x25ff228, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x6a6ee68, lpOverlapped=0x0 | out: lpBuffer=0x25ff228*, lpNumberOfBytesRead=0x6a6ee68*=0x1000, lpOverlapped=0x0) returned 1 [0208.764] ReadFile (in: hFile=0x284, lpBuffer=0x25ff228, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x6a6ee68, lpOverlapped=0x0 | out: lpBuffer=0x25ff228*, lpNumberOfBytesRead=0x6a6ee68*=0x1000, lpOverlapped=0x0) returned 1 [0208.764] ReadFile (in: hFile=0x284, lpBuffer=0x25ff228, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x6a6ee68, lpOverlapped=0x0 | out: lpBuffer=0x25ff228*, lpNumberOfBytesRead=0x6a6ee68*=0x1000, lpOverlapped=0x0) returned 1 [0208.765] CloseHandle (hObject=0x284) returned 1 [0209.184] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\logins.json", nBufferLength=0x105, lpBuffer=0x6a6e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\logins.json", lpFilePart=0x0) returned 0x63 [0209.184] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\tempDataBase2020-10-05T18_43_57.4222000+11_0088", nBufferLength=0x105, lpBuffer=0x6a6e9cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\tempDataBase2020-10-05T18_43_57.4222000+11_0088", lpFilePart=0x0) returned 0x60 [0209.184] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\logins.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\logins.json"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\tempDataBase2020-10-05T18_43_57.4222000+11_0088" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\tempdatabase2020-10-05t18_43_57.4222000+11_0088"), bFailIfExists=0) returned 0 [0209.185] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\logins.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\logins.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0209.188] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\key4.db", nBufferLength=0x105, lpBuffer=0x6a6ea14, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\key4.db", lpFilePart=0x0) returned 0x5f [0209.188] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\tempDataBase2020-10-05T18_43_57.4222000+11_0088", nBufferLength=0x105, lpBuffer=0x6a6ea14, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\tempDataBase2020-10-05T18_43_57.4222000+11_0088", lpFilePart=0x0) returned 0x60 [0209.188] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\key4.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\key4.db"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\tempDataBase2020-10-05T18_43_57.4222000+11_0088" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\tempdatabase2020-10-05t18_43_57.4222000+11_0088"), bFailIfExists=0) returned 0 [0209.188] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\key4.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\key4.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0209.189] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x6a6eaf4, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0209.190] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Gecko Logins.txt", nBufferLength=0x105, lpBuffer=0x6a6eb08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Gecko Logins.txt", lpFilePart=0x0) returned 0x83 [0209.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ef68) returned 1 [0209.190] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\Gecko Logins.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\gecko logins.txt"), fInfoLevelId=0x0, lpFileInformation=0x6a6efe4 | out: lpFileInformation=0x6a6efe4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0209.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ef64) returned 1 [0209.238] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", nBufferLength=0x105, lpBuffer=0x6a6eaac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", lpFilePart=0x0) returned 0x46 [0209.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ef08) returned 1 [0209.238] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles"), fInfoLevelId=0x0, lpFileInformation=0x6a6ef84 | out: lpFileInformation=0x6a6ef84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0209.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ef04) returned 1 [0209.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ef84) returned 1 [0209.239] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", nBufferLength=0x105, lpBuffer=0x6a6ea8c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", lpFilePart=0x0) returned 0x46 [0209.239] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\", nBufferLength=0x105, lpBuffer=0x6a6ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\", lpFilePart=0x0) returned 0x47 [0209.239] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*", lpFindFileData=0x6a6ecac | out: lpFindFileData=0x6a6ecac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9e4b20 [0209.239] FindNextFileW (in: hFindFile=0x9e4b20, lpFindFileData=0x6a6ecbc | out: lpFindFileData=0x6a6ecbc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.239] FindNextFileW (in: hFindFile=0x9e4b20, lpFindFileData=0x6a6ecbc | out: lpFindFileData=0x6a6ecbc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 1 [0209.239] FindNextFileW (in: hFindFile=0x9e4b20, lpFindFileData=0x6a6ecbc | out: lpFindFileData=0x6a6ecbc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.240] FindClose (in: hFindFile=0x9e4b20 | out: hFindFile=0x9e4b20) returned 1 [0209.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ef44) returned 1 [0209.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ef50) returned 1 [0209.240] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\logins.json", nBufferLength=0x105, lpBuffer=0x6a6eab4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\logins.json", lpFilePart=0x0) returned 0x63 [0209.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ef14) returned 1 [0209.240] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\logins.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\logins.json"), fInfoLevelId=0x0, lpFileInformation=0x6a6ef90 | out: lpFileInformation=0x6a6ef90*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0209.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ef10) returned 1 [0209.240] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\key4.db", nBufferLength=0x105, lpBuffer=0x6a6eab4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\key4.db", lpFilePart=0x0) returned 0x5f [0209.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ef14) returned 1 [0209.240] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\key4.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\key4.db"), fInfoLevelId=0x0, lpFileInformation=0x6a6ef90 | out: lpFileInformation=0x6a6ef90*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0209.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ef10) returned 1 [0209.240] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\places.SQLiteHandler", nBufferLength=0x105, lpBuffer=0x6a6eab4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\places.SQLiteHandler", lpFilePart=0x0) returned 0x6c [0209.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6a6ef14) returned 1 [0209.241] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\places.SQLiteHandler" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\places.sqlitehandler"), fInfoLevelId=0x0, lpFileInformation=0x6a6ef90 | out: lpFileInformation=0x6a6ef90*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0209.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6a6ef10) returned 1 [0209.288] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.291] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.293] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.297] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.298] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.299] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.303] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.307] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.323] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.325] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.346] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.398] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.409] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.410] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.418] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.418] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.419] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.424] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.437] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.439] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.440] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.734] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.736] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.756] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.803] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.820] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.822] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.824] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.850] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.899] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.944] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.069] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.080] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.083] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.098] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.103] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.109] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.116] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.131] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.145] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.146] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.178] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.226] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.271] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.396] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.421] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.443] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.536] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.566] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.577] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.898] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.922] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.926] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.927] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.930] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.931] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.932] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.933] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.933] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.934] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.935] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.018] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.019] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.020] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.020] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.021] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.021] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.022] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.022] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.035] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.036] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.036] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.036] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.037] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.037] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.354] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.364] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.364] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.365] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.365] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.365] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.370] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.370] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.371] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.375] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.380] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.382] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.382] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.382] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.382] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.382] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.382] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.382] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.382] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.382] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.382] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.382] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.382] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.382] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.382] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.382] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.382] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.383] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.383] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.383] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.383] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.383] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.383] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.383] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.383] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.383] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.383] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.383] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.383] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.383] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.383] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.383] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.383] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.383] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.383] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.383] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.383] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.383] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.383] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.383] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 Thread: id = 172 os_tid = 0x5cc Thread: id = 173 os_tid = 0x728 Thread: id = 174 os_tid = 0x724 Thread: id = 176 os_tid = 0x620 Thread: id = 182 os_tid = 0x774 Thread: id = 183 os_tid = 0x7a4 Thread: id = 184 os_tid = 0x6e8 Thread: id = 185 os_tid = 0x314 Thread: id = 186 os_tid = 0x7b0 [0217.686] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0217.689] SetConsoleCtrlHandler (HandlerRoutine=0x461088e, Add=1) returned 1 [0217.690] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0217.690] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0217.691] GetClassInfoW (in: hInstance=0x400000, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.2e65425.0", lpWndClass=0x24c7d50 | out: lpWndClass=0x24c7d50) returned 0 [0217.693] CoTaskMemAlloc (cb=0x58) returned 0xa3c118 [0217.693] RegisterClassW (lpWndClass=0x62af1f4) returned 0xc11f [0217.693] CoTaskMemFree (pv=0xa3c118) [0217.693] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.2e65425.0", lpWindowName=".NET-BroadcastEventWindow.4.0.0.0.2e65425.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x60152 [0217.695] NtdllDefWindowProc_W () returned 0x0 [0217.695] NtdllDefWindowProc_W () returned 0x0 [0217.695] NtdllDefWindowProc_W () returned 0x0 [0217.695] NtdllDefWindowProc_W () returned 0x0 [0217.695] SetEvent (hEvent=0x30c) returned 1 [0217.823] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0217.837] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0217.959] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0217.962] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0218.085] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0218.087] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0218.314] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0218.339] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0218.497] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0218.511] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0218.653] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0218.664] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0218.778] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0218.802] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0218.922] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0218.930] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0219.143] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0219.150] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0219.257] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0219.272] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0219.382] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0219.397] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0219.506] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0219.522] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0219.631] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0219.647] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0219.756] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0219.771] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0219.881] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0219.896] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0220.006] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0220.022] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0220.131] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0220.188] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0220.286] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0220.304] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0220.411] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0220.427] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0220.536] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0220.552] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0220.661] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0220.677] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0220.786] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0220.801] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0220.910] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0220.927] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0221.035] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0221.051] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0221.160] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0221.176] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0221.285] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0221.301] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0221.410] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0221.425] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0221.534] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0221.550] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0221.659] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0221.675] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0221.784] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0221.800] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0221.909] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0221.925] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0222.034] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0222.049] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0222.159] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0222.174] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0222.284] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0222.299] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0222.408] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0222.424] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0222.534] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0222.549] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0222.658] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0222.675] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0222.782] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0222.798] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0222.907] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0222.925] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0223.032] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0223.061] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0223.157] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0223.176] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0223.661] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0223.704] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0223.843] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0223.891] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0223.999] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0224.015] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0224.124] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0224.140] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0224.249] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0224.264] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0224.375] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0224.389] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0224.499] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0224.514] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0224.647] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0224.654] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x0 [0224.655] PeekMessageW (in: lpMsg=0x62af2e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x62af2e4) returned 1 [0224.655] IsWindow (hWnd=0x60152) returned 1 [0224.656] GetModuleHandleW (lpModuleName="user32.dll") returned 0x75610000 [0224.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="DefWindowProcW", cchWideChar=14, lpMultiByteStr=0x62af1f0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefWindowProcWµs\x0b9­\x1a\x94ÂOtÀò*\x06Àø£", lpUsedDefaultChar=0x0) returned 14 [0224.656] GetProcAddress (hModule=0x75610000, lpProcName="DefWindowProcW") returned 0x770a25dd [0224.656] SetWindowLongW (hWnd=0x60152, nIndex=-4, dwNewLong=1997153757) returned 73468086 [0224.657] SetClassLongW (hWnd=0x60152, nIndex=-24, dwNewLong=1997153757) returned 0x46108b6 [0224.657] IsWindow (hWnd=0x60152) returned 1 [0224.657] DestroyWindow (hWnd=0x60152) returned 1 [0224.659] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0224.659] UnregisterClassW (lpClassName=".NET-BroadcastEventWindow.4.0.0.0.2e65425.0", hInstance=0x400000) returned 1 [0224.660] SetConsoleCtrlHandler (HandlerRoutine=0x461088e, Add=0) returned 1 [0224.660] SetEvent (hEvent=0x254) returned 1 [0224.660] CoGetContextToken (in: pToken=0x62af62c | out: pToken=0x62af62c) returned 0x0 [0224.660] IUnknown:QueryInterface (in: This=0x98faa0, riid=0x7463d8c4*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x62af650 | out: ppvObject=0x62af650*=0x98faac) returned 0x0 [0224.660] IComThreadingInfo:GetCurrentThreadType (in: This=0x98faac, pThreadType=0x62af67c | out: pThreadType=0x62af67c*=0) returned 0x0 [0224.660] IUnknown:Release (This=0x98faac) returned 0x1 [0224.660] CoUninitialize () Thread: id = 187 os_tid = 0x338 Thread: id = 188 os_tid = 0x77c [0218.548] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0218.549] ResetEvent (hEvent=0x34c) returned 1 Thread: id = 189 os_tid = 0x59c Thread: id = 190 os_tid = 0x5ac Thread: id = 191 os_tid = 0x5e4 Thread: id = 192 os_tid = 0x65c [0220.354] CoGetContextToken (in: pToken=0x65ffbf4 | out: pToken=0x65ffbf4) returned 0x0 [0220.355] IUnknown:QueryInterface (in: This=0x98faa0, riid=0x7463d8c4*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x65ffc18 | out: ppvObject=0x65ffc18*=0x98faac) returned 0x0 [0220.356] IComThreadingInfo:GetCurrentThreadType (in: This=0x98faac, pThreadType=0x65ffc44 | out: pThreadType=0x65ffc44*=0) returned 0x0 [0220.356] IUnknown:Release (This=0x98faac) returned 0x1 [0220.356] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0220.356] SleepEx (dwMilliseconds=0xffffffff, bAlertable=1) returned 0xc0 [0220.364] SleepEx (dwMilliseconds=0x186a0, bAlertable=1) returned 0xc0 [0224.684] SleepEx (dwMilliseconds=0xffffffff, bAlertable=1) Thread: id = 193 os_tid = 0x33c [0223.025] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0223.025] CoGetContextToken (in: pToken=0x6d1f2ec | out: pToken=0x6d1f2ec) returned 0x0 [0223.025] IUnknown:QueryInterface (in: This=0x98faa0, riid=0x7463d8c4*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x6d1f310 | out: ppvObject=0x6d1f310*=0x98faac) returned 0x0 [0223.025] IComThreadingInfo:GetCurrentThreadType (in: This=0x98faac, pThreadType=0x6d1f33c | out: pThreadType=0x6d1f33c*=0) returned 0x0 [0223.025] IUnknown:Release (This=0x98faac) returned 0x1 [0223.025] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0223.025] CoUninitialize () [0223.039] setsockopt (s=0x32c, level=65535, optname=28688, optval=0x0, optlen=0) returned 0 [0223.040] closesocket (s=0x348) returned 0 [0223.049] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x6d1ed20 | out: phkResult=0x6d1ed20*=0x348) returned 0x0 [0223.049] RegQueryValueExW (in: hKey=0x348, lpValueName="SchUseStrongCrypto", lpReserved=0x0, lpType=0x6d1ed3c, lpData=0x0, lpcbData=0x6d1ed38*=0x0 | out: lpType=0x6d1ed3c*=0x0, lpData=0x0, lpcbData=0x6d1ed38*=0x0) returned 0x2 [0223.049] RegCloseKey (hKey=0x348) returned 0x0 [0223.059] EnumerateSecurityPackagesW (in: pcPackages=0x6d1ed2c, ppPackageInfo=0x6d1ecc0 | out: pcPackages=0x6d1ed2c, ppPackageInfo=0x6d1ecc0) returned 0x0 [0223.165] FreeContextBuffer (in: pvContextBuffer=0x60bf838 | out: pvContextBuffer=0x60bf838) returned 0x0 [0223.169] GetCurrentProcess () returned 0xffffffff [0223.169] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x6d1eb0c | out: TokenHandle=0x6d1eb0c*=0x348) returned 1 [0223.170] AcquireCredentialsHandleW (in: pPrincipal=0x0, pPackage=0x25121c8, fCredentialUse=0x2, pvLogonId=0x0, pAuthData=0x6d1eb60, pGetKeyFn=0x0, pvGetKeyArgument=0x0, phCredential=0x2513764, ptsExpiry=0x6d1eae4 | out: phCredential=0x2513764, ptsExpiry=0x6d1eae4) returned 0x0 [0223.370] InitializeSecurityContextW (in: phCredential=0x6d1eb24, phContext=0x0, pTargetName=0x250fb60, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x0, Reserved2=0x0, phNewContext=0x2513958, pOutput=0x25138f0, pfContextAttr=0x251219c, ptsExpiry=0x6d1eb1c | out: phNewContext=0x2513958, pOutput=0x25138f0, pfContextAttr=0x251219c, ptsExpiry=0x6d1eb1c) returned 0x90312 [0223.371] FreeContextBuffer (in: pvContextBuffer=0xa27428 | out: pvContextBuffer=0xa27428) returned 0x0 [0223.375] WSASend (in: s=0x32c, lpBuffers=0x2513b0c*=((len=0x76, buf=0x251396c*)), dwBufferCount=0x1, lpNumberOfBytesSent=0x6d1ec14, dwFlags=0x0, lpOverlapped=0x250f254, lpCompletionRoutine=0x0 | out: lpNumberOfBytesSent=0x6d1ec14*=0x76, lpOverlapped=0x250f254) returned 0 [0223.377] WSARecv (in: s=0x32c, lpBuffers=0x2513d0c, dwBufferCount=0x1, lpNumberOfBytesRecvd=0x6d1ee4c, lpFlags=0x6d1ee7c*=0x0, lpOverlapped=0x250f208, lpCompletionRoutine=0x0 | out: lpBuffers=0x2513d0c*=((len=0x5, buf=0x251396c*)), lpNumberOfBytesRecvd=0x6d1ee4c*=0x0, lpFlags=0x6d1ee7c*=0x0, lpOverlapped=0x250f208) returned 0 [0223.398] WSARecv (in: s=0x32c, lpBuffers=0x25143ac, dwBufferCount=0x1, lpNumberOfBytesRecvd=0x6d1ee24, lpFlags=0x6d1ee54*=0x0, lpOverlapped=0x250f208, lpCompletionRoutine=0x0 | out: lpBuffers=0x25143ac*=((len=0x5b, buf=0x2513971*)), lpNumberOfBytesRecvd=0x6d1ee24*=0x5b, lpFlags=0x6d1ee54*=0x0, lpOverlapped=0x250f208) returned 0 [0223.398] InitializeSecurityContextW (in: phCredential=0x6d1ed18, phContext=0x6d1eda4, pTargetName=0x250fb60, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x25144e0, Reserved2=0x0, phNewContext=0x2513958, pOutput=0x25144f4, pfContextAttr=0x251219c, ptsExpiry=0x6d1ed10 | out: phNewContext=0x2513958, pOutput=0x25144f4, pfContextAttr=0x251219c, ptsExpiry=0x6d1ed10) returned 0x90312 [0223.399] WSARecv (in: s=0x32c, lpBuffers=0x25145e8, dwBufferCount=0x1, lpNumberOfBytesRecvd=0x6d1edc4, lpFlags=0x6d1edf4*=0x0, lpOverlapped=0x250f208, lpCompletionRoutine=0x0 | out: lpBuffers=0x25145e8*=((len=0x5, buf=0x2514584*)), lpNumberOfBytesRecvd=0x6d1edc4*=0x5, lpFlags=0x6d1edf4*=0x0, lpOverlapped=0x250f208) returned 0 [0223.399] WSARecv (in: s=0x32c, lpBuffers=0x25158dc, dwBufferCount=0x1, lpNumberOfBytesRecvd=0x6d1ee24, lpFlags=0x6d1ee54*=0x0, lpOverlapped=0x250f208, lpCompletionRoutine=0x0 | out: lpBuffers=0x25158dc*=((len=0x11ec, buf=0x2514691*)), lpNumberOfBytesRecvd=0x6d1ee24*=0x11ec, lpFlags=0x6d1ee54*=0x0, lpOverlapped=0x250f208) returned 0 [0223.399] InitializeSecurityContextW (in: phCredential=0x6d1ed18, phContext=0x6d1eda4, pTargetName=0x250fb60, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x25159e4, Reserved2=0x0, phNewContext=0x2513958, pOutput=0x25159f8, pfContextAttr=0x251219c, ptsExpiry=0x6d1ed10 | out: phNewContext=0x2513958, pOutput=0x25159f8, pfContextAttr=0x251219c, ptsExpiry=0x6d1ed10) returned 0x90312 [0223.401] WSARecv (in: s=0x32c, lpBuffers=0x2515aec, dwBufferCount=0x1, lpNumberOfBytesRecvd=0x6d1edc4, lpFlags=0x6d1edf4*=0x0, lpOverlapped=0x250f208, lpCompletionRoutine=0x0 | out: lpBuffers=0x2515aec*=((len=0x5, buf=0x2515a88*)), lpNumberOfBytesRecvd=0x6d1edc4*=0x5, lpFlags=0x6d1edf4*=0x0, lpOverlapped=0x250f208) returned 0 [0223.401] WSARecv (in: s=0x32c, lpBuffers=0x2515d3c, dwBufferCount=0x1, lpNumberOfBytesRecvd=0x6d1ee24, lpFlags=0x6d1ee54*=0x0, lpOverlapped=0x250f208, lpCompletionRoutine=0x0 | out: lpBuffers=0x2515d3c*=((len=0x14b, buf=0x2515b95*)), lpNumberOfBytesRecvd=0x6d1ee24*=0x14b, lpFlags=0x6d1ee54*=0x0, lpOverlapped=0x250f208) returned 0 [0223.402] InitializeSecurityContextW (in: phCredential=0x6d1ed18, phContext=0x6d1eda4, pTargetName=0x250fb60, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x2515e44, Reserved2=0x0, phNewContext=0x2513958, pOutput=0x2515e58, pfContextAttr=0x251219c, ptsExpiry=0x6d1ed10 | out: phNewContext=0x2513958, pOutput=0x2515e58, pfContextAttr=0x251219c, ptsExpiry=0x6d1ed10) returned 0x90312 [0223.402] WSARecv (in: s=0x32c, lpBuffers=0x2515f4c, dwBufferCount=0x1, lpNumberOfBytesRecvd=0x6d1edc4, lpFlags=0x6d1edf4*=0x0, lpOverlapped=0x250f208, lpCompletionRoutine=0x0 | out: lpBuffers=0x2515f4c*=((len=0x5, buf=0x2515ee8*)), lpNumberOfBytesRecvd=0x6d1edc4*=0x5, lpFlags=0x6d1edf4*=0x0, lpOverlapped=0x250f208) returned 0 [0223.402] WSARecv (in: s=0x32c, lpBuffers=0x2516058, dwBufferCount=0x1, lpNumberOfBytesRecvd=0x6d1ee24, lpFlags=0x6d1ee54*=0x0, lpOverlapped=0x250f208, lpCompletionRoutine=0x0 | out: lpBuffers=0x2516058*=((len=0x4, buf=0x2515ff5*)), lpNumberOfBytesRecvd=0x6d1ee24*=0x4, lpFlags=0x6d1ee54*=0x0, lpOverlapped=0x250f208) returned 0 [0223.402] InitializeSecurityContextW (in: phCredential=0x6d1ed18, phContext=0x6d1eda4, pTargetName=0x250fb60, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x2516160, Reserved2=0x0, phNewContext=0x2513958, pOutput=0x2516174, pfContextAttr=0x251219c, ptsExpiry=0x6d1ed10 | out: phNewContext=0x2513958, pOutput=0x2516174, pfContextAttr=0x251219c, ptsExpiry=0x6d1ed10) returned 0x90312 [0223.446] FreeContextBuffer (in: pvContextBuffer=0xa11080 | out: pvContextBuffer=0xa11080) returned 0x0 [0223.446] WSASend (in: s=0x32c, lpBuffers=0x25162e8*=((len=0x86, buf=0x25161f0*)), dwBufferCount=0x1, lpNumberOfBytesSent=0x6d1ee0c, dwFlags=0x0, lpOverlapped=0x250f254, lpCompletionRoutine=0x0 | out: lpNumberOfBytesSent=0x6d1ee0c*=0x86, lpOverlapped=0x250f254) returned 0 [0223.447] WSARecv (in: s=0x32c, lpBuffers=0x25163dc, dwBufferCount=0x1, lpNumberOfBytesRecvd=0x6d1ee4c, lpFlags=0x6d1ee7c*=0x0, lpOverlapped=0x250f208, lpCompletionRoutine=0x0 | out: lpBuffers=0x25163dc*=((len=0x5, buf=0x25161f0*)), lpNumberOfBytesRecvd=0x6d1ee4c*=0x0, lpFlags=0x6d1ee7c*=0x0, lpOverlapped=0x250f208) returned 0 [0223.460] WSARecv (in: s=0x32c, lpBuffers=0x25164d0, dwBufferCount=0x1, lpNumberOfBytesRecvd=0x6d1ee24, lpFlags=0x6d1ee54*=0x0, lpOverlapped=0x250f208, lpCompletionRoutine=0x0 | out: lpBuffers=0x25164d0*=((len=0x1, buf=0x25161f5*)), lpNumberOfBytesRecvd=0x6d1ee24*=0x1, lpFlags=0x6d1ee54*=0x0, lpOverlapped=0x250f208) returned 0 [0223.460] InitializeSecurityContextW (in: phCredential=0x6d1ed18, phContext=0x6d1eda4, pTargetName=0x250fb60, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x25165a0, Reserved2=0x0, phNewContext=0x2513958, pOutput=0x25165b4, pfContextAttr=0x251219c, ptsExpiry=0x6d1ed10 | out: phNewContext=0x2513958, pOutput=0x25165b4, pfContextAttr=0x251219c, ptsExpiry=0x6d1ed10) returned 0x90312 [0223.460] WSARecv (in: s=0x32c, lpBuffers=0x25166a8, dwBufferCount=0x1, lpNumberOfBytesRecvd=0x6d1edc4, lpFlags=0x6d1edf4*=0x0, lpOverlapped=0x250f208, lpCompletionRoutine=0x0 | out: lpBuffers=0x25166a8*=((len=0x5, buf=0x2516644*)), lpNumberOfBytesRecvd=0x6d1edc4*=0x5, lpFlags=0x6d1edf4*=0x0, lpOverlapped=0x250f208) returned 0 [0223.460] WSARecv (in: s=0x32c, lpBuffers=0x25167e0, dwBufferCount=0x1, lpNumberOfBytesRecvd=0x6d1ee24, lpFlags=0x6d1ee54*=0x0, lpOverlapped=0x250f208, lpCompletionRoutine=0x0 | out: lpBuffers=0x25167e0*=((len=0x30, buf=0x2516751*)), lpNumberOfBytesRecvd=0x6d1ee24*=0x30, lpFlags=0x6d1ee54*=0x0, lpOverlapped=0x250f208) returned 0 [0223.460] InitializeSecurityContextW (in: phCredential=0x6d1ed18, phContext=0x6d1eda4, pTargetName=0x250fb60, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x25168e8, Reserved2=0x0, phNewContext=0x2513958, pOutput=0x25168fc, pfContextAttr=0x251219c, ptsExpiry=0x6d1ed10 | out: phNewContext=0x2513958, pOutput=0x25168fc, pfContextAttr=0x251219c, ptsExpiry=0x6d1ed10) returned 0x0 [0223.638] QueryContextAttributesW (in: phContext=0x2513958, ulAttribute=0x4, pBuffer=0x25169a8 | out: pBuffer=0x25169a8) returned 0x0 [0223.639] QueryContextAttributesW (in: phContext=0x2513958, ulAttribute=0x5a, pBuffer=0x2516a00 | out: pBuffer=0x2516a00) returned 0x0 [0223.641] QueryContextAttributesW (in: phContext=0x2513958, ulAttribute=0x53, pBuffer=0x2516cb4 | out: pBuffer=0x2516cb4) returned 0x0 [0223.647] CertDuplicateCRLContext (pCrlContext=0x609ee18) returned 0x609ee18 [0223.647] CertDuplicateStore (hCertStore=0x60ac308) returned 0x60ac308 [0223.648] CertEnumCertificatesInStore (hCertStore=0x60ac308, pPrevCertContext=0x0) returned 0x609eeb8 [0223.648] CertDuplicateCRLContext (pCrlContext=0x609eeb8) returned 0x609eeb8 [0223.648] CertEnumCertificatesInStore (hCertStore=0x60ac308, pPrevCertContext=0x609eeb8) returned 0x609ee68 [0223.648] CertDuplicateCRLContext (pCrlContext=0x609ee68) returned 0x609ee68 [0223.648] CertEnumCertificatesInStore (hCertStore=0x60ac308, pPrevCertContext=0x609ee68) returned 0x609ee18 [0223.649] CertDuplicateCRLContext (pCrlContext=0x609ee18) returned 0x609ee18 [0223.649] CertEnumCertificatesInStore (hCertStore=0x60ac308, pPrevCertContext=0x609ee18) returned 0x0 [0223.649] CertCloseStore (hCertStore=0x60ac308, dwFlags=0x0) returned 1 [0223.649] CertFreeCRLContext (pCrlContext=0x609ee18) returned 1 [0223.658] CertOpenStore (lpszStoreProvider=0x2, dwEncodingType=0x10001, hCryptProv=0x0, dwFlags=0x2204, pvPara=0x0) returned 0x60ac380 [0223.659] CertAddCRLLinkToStore (in: hCertStore=0x60ac380, pCrlContext=0x609eeb8, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0223.660] CertAddCRLLinkToStore (in: hCertStore=0x60ac380, pCrlContext=0x609ee68, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0223.660] CertAddCRLLinkToStore (in: hCertStore=0x60ac380, pCrlContext=0x609ee18, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0223.665] CertGetCertificateChain (in: hChainEngine=0x0, pCertContext=0x609ee18, pTime=0x6d1ed24, hAdditionalStore=0x60ac380, pChainPara=0x6d1ec64, dwFlags=0x0, pvReserved=0x0, ppChainContext=0x6d1ec58 | out: ppChainContext=0x6d1ec58) returned 1 [0223.943] CertDuplicateCertificateChain (pChainContext=0xa0b808) returned 0xa0b808 [0223.943] CertDuplicateCRLContext (pCrlContext=0x609ee18) returned 0x609ee18 [0223.944] CertDuplicateCRLContext (pCrlContext=0x6e99010) returned 0x6e99010 [0223.944] CertDuplicateCRLContext (pCrlContext=0x6e99060) returned 0x6e99060 [0223.944] CertFreeCertificateChain (pChainContext=0xa0b808) [0223.944] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x1, pChainContext=0xa0b808, pPolicyPara=0x6d1ee04, pPolicyStatus=0x6d1edf0 | out: pPolicyStatus=0x6d1edf0) returned 1 [0223.945] SetLastError (dwErrCode=0x0) [0223.947] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x4, pChainContext=0xa0b808, pPolicyPara=0x6d1ee70, pPolicyStatus=0x6d1ee18 | out: pPolicyStatus=0x6d1ee18) returned 1 [0223.949] CertFreeCertificateChain (pChainContext=0xa0b808) [0223.949] CertFreeCRLContext (pCrlContext=0x609ee18) returned 1 [0223.951] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_Disabled", lpBuffer=0x6d1e43c, nSize=0x80 | out: lpBuffer="ꑂ瑢") returned 0x0 [0223.951] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_MinCount", lpBuffer=0x6d1e43c, nSize=0x80 | out: lpBuffer="ꑂ瑢") returned 0x0 [0223.951] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_Disabled", lpBuffer=0x6d1e43c, nSize=0x80 | out: lpBuffer="ꑂ瑢") returned 0x0 [0223.951] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_MinCount", lpBuffer=0x6d1e43c, nSize=0x80 | out: lpBuffer="ꑂ瑢") returned 0x0 [0223.952] EncryptMessage (in: phContext=0x2513958, fQOP=0x0, pMessage=0x251eeb8, MessageSeqNo=0x0 | out: pMessage=0x251eeb8) returned 0x0 [0223.952] WSASend (in: s=0x32c, lpBuffers=0x251ef94*=((len=0x145, buf=0x251d990*)), dwBufferCount=0x1, lpNumberOfBytesSent=0x6d1ec44, dwFlags=0x0, lpOverlapped=0x250f254, lpCompletionRoutine=0x0 | out: lpNumberOfBytesSent=0x6d1ec44*=0x145, lpOverlapped=0x250f254) returned 0 [0223.953] SetEvent (hEvent=0x34c) returned 1 [0223.953] WSARecv (in: s=0x32c, lpBuffers=0x252f390, dwBufferCount=0x1, lpNumberOfBytesRecvd=0x6d1eb98, lpFlags=0x6d1ebc8*=0x0, lpOverlapped=0x250f208, lpCompletionRoutine=0x0 | out: lpBuffers=0x252f390*=((len=0x5, buf=0x252b308*)), lpNumberOfBytesRecvd=0x6d1eb98*=0x0, lpFlags=0x6d1ebc8*=0x0, lpOverlapped=0x250f208) returned 0 [0223.971] WSARecv (in: s=0x32c, lpBuffers=0x252f498, dwBufferCount=0x1, lpNumberOfBytesRecvd=0x6d1ee14, lpFlags=0x6d1ee44*=0x0, lpOverlapped=0x250f208, lpCompletionRoutine=0x0 | out: lpBuffers=0x252f498*=((len=0x30, buf=0x252b30d*)), lpNumberOfBytesRecvd=0x6d1ee14*=0x30, lpFlags=0x6d1ee44*=0x0, lpOverlapped=0x250f208) returned 0 [0223.972] DecryptMessage (in: phContext=0x2513958, pMessage=0x252f58c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x252f58c, pfQOP=0x0) returned 0x0 [0223.972] WSARecv (in: s=0x32c, lpBuffers=0x252f7b4, dwBufferCount=0x1, lpNumberOfBytesRecvd=0x6d1ebf8, lpFlags=0x6d1ec28*=0x0, lpOverlapped=0x250f208, lpCompletionRoutine=0x0 | out: lpBuffers=0x252f7b4*=((len=0x5, buf=0x252b308)), lpNumberOfBytesRecvd=0x6d1ebf8*=0x0, lpFlags=0x6d1ec28*=0x0, lpOverlapped=0x250f208) returned 0xffffffff [0223.974] EncryptMessage (in: phContext=0x2513958, fQOP=0x0, pMessage=0x252fb9c, MessageSeqNo=0x0 | out: pMessage=0x252fb9c) returned 0x0 [0223.974] WSASend (in: s=0x32c, lpBuffers=0x252fc78*=((len=0x45, buf=0x251d990*)), dwBufferCount=0x1, lpNumberOfBytesSent=0x6d1e94c, dwFlags=0x0, lpOverlapped=0x250f254, lpCompletionRoutine=0x0 | out: lpNumberOfBytesSent=0x6d1e94c*=0x45, lpOverlapped=0x250f254) returned 0 [0223.976] EncryptMessage (in: phContext=0x2513958, fQOP=0x0, pMessage=0x253084c, MessageSeqNo=0x0 | out: pMessage=0x253084c) returned 0x0 [0223.976] WSASend (in: s=0x32c, lpBuffers=0x2530928*=((len=0x85, buf=0x2530730*)), dwBufferCount=0x1, lpNumberOfBytesSent=0x6d1e820, dwFlags=0x0, lpOverlapped=0x250f254, lpCompletionRoutine=0x0 | out: lpNumberOfBytesSent=0x6d1e820*=0x85, lpOverlapped=0x250f254) returned 0 [0223.976] EncryptMessage (in: phContext=0x2513958, fQOP=0x0, pMessage=0x2530c54, MessageSeqNo=0x0 | out: pMessage=0x2530c54) returned 0x0 [0223.976] WSASend (in: s=0x32c, lpBuffers=0x2530d30*=((len=0x45, buf=0x251d990*)), dwBufferCount=0x1, lpNumberOfBytesSent=0x6d1e7e8, dwFlags=0x0, lpOverlapped=0x250f254, lpCompletionRoutine=0x0 | out: lpNumberOfBytesSent=0x6d1e7e8*=0x45, lpOverlapped=0x250f254) returned 0 [0223.976] EncryptMessage (in: phContext=0x2513958, fQOP=0x0, pMessage=0x25318a8, MessageSeqNo=0x0 | out: pMessage=0x25318a8) returned 0x0 [0223.976] WSASend (in: s=0x32c, lpBuffers=0x2531984*=((len=0xa5, buf=0x2531764*)), dwBufferCount=0x1, lpNumberOfBytesSent=0x6d1e568, dwFlags=0x0, lpOverlapped=0x250f254, lpCompletionRoutine=0x0 | out: lpNumberOfBytesSent=0x6d1e568*=0xa5, lpOverlapped=0x250f254) returned 0 [0223.977] EncryptMessage (in: phContext=0x2513958, fQOP=0x0, pMessage=0x2531c78, MessageSeqNo=0x0 | out: pMessage=0x2531c78) returned 0x0 [0223.977] WSASend (in: s=0x32c, lpBuffers=0x2531d54*=((len=0x25, buf=0x251d990*)), dwBufferCount=0x1, lpNumberOfBytesSent=0x6d1e7e8, dwFlags=0x0, lpOverlapped=0x250f254, lpCompletionRoutine=0x0 | out: lpNumberOfBytesSent=0x6d1e7e8*=0x25, lpOverlapped=0x250f254) returned 0 [0223.977] EncryptMessage (in: phContext=0x2513958, fQOP=0x0, pMessage=0x25328bc, MessageSeqNo=0x0 | out: pMessage=0x25328bc) returned 0x0 [0223.977] WSASend (in: s=0x32c, lpBuffers=0x2532998*=((len=0xa5, buf=0x253277c*)), dwBufferCount=0x1, lpNumberOfBytesSent=0x6d1e568, dwFlags=0x0, lpOverlapped=0x250f254, lpCompletionRoutine=0x0 | out: lpNumberOfBytesSent=0x6d1e568*=0xa5, lpOverlapped=0x250f254) returned 0 [0223.977] EncryptMessage (in: phContext=0x2513958, fQOP=0x0, pMessage=0x2532c8c, MessageSeqNo=0x0 | out: pMessage=0x2532c8c) returned 0x0 [0223.977] WSASend (in: s=0x32c, lpBuffers=0x2532d68*=((len=0xd5, buf=0x251d990*)), dwBufferCount=0x1, lpNumberOfBytesSent=0x6d1e7e8, dwFlags=0x0, lpOverlapped=0x250f254, lpCompletionRoutine=0x0 | out: lpNumberOfBytesSent=0x6d1e7e8*=0xd5, lpOverlapped=0x250f254) returned 0 [0223.977] EncryptMessage (in: phContext=0x2513958, fQOP=0x0, pMessage=0x2533d5c, MessageSeqNo=0x0 | out: pMessage=0x2533d5c) returned 0x0 [0223.977] WSASend (in: s=0x32c, lpBuffers=0x2533e38*=((len=0xc5, buf=0x2533bf8*)), dwBufferCount=0x1, lpNumberOfBytesSent=0x6d1e568, dwFlags=0x0, lpOverlapped=0x250f254, lpCompletionRoutine=0x0 | out: lpNumberOfBytesSent=0x6d1e568*=0xc5, lpOverlapped=0x250f254) returned 0 [0223.977] EncryptMessage (in: phContext=0x2513958, fQOP=0x0, pMessage=0x2538138, MessageSeqNo=0x0 | out: pMessage=0x2538138) returned 0x0 [0223.978] WSASend (in: s=0x32c, lpBuffers=0x2538214*=((len=0x3ff5, buf=0x25340a4*)), dwBufferCount=0x1, lpNumberOfBytesSent=0x6d1e7e8, dwFlags=0x0, lpOverlapped=0x250f254, lpCompletionRoutine=0x0 | out: lpNumberOfBytesSent=0x6d1e7e8*=0x3ff5, lpOverlapped=0x250f254) returned 0 [0223.978] EncryptMessage (in: phContext=0x2513958, fQOP=0x0, pMessage=0x253c3ec, MessageSeqNo=0x0 | out: pMessage=0x253c3ec) returned 0x0 [0223.978] WSASend (in: s=0x32c, lpBuffers=0x253c4c8*=((len=0x3ff5, buf=0x2538358*)), dwBufferCount=0x1, lpNumberOfBytesSent=0x6d1ee48, dwFlags=0x0, lpOverlapped=0x250f254, lpCompletionRoutine=0x0 | out: lpNumberOfBytesSent=0x6d1ee48*=0x0, lpOverlapped=0x250f254) returned 0 [0223.996] EncryptMessage (in: phContext=0x2513958, fQOP=0x0, pMessage=0x2540600, MessageSeqNo=0x0 | out: pMessage=0x2540600) returned 0x0 [0223.996] WSASend (in: s=0x32c, lpBuffers=0x25406dc*=((len=0x3ff5, buf=0x253c56c*)), dwBufferCount=0x1, lpNumberOfBytesSent=0x6d1ee48, dwFlags=0x0, lpOverlapped=0x250f254, lpCompletionRoutine=0x0 | out: lpNumberOfBytesSent=0x6d1ee48*=0x0, lpOverlapped=0x250f254) returned 0 [0224.046] EncryptMessage (in: phContext=0x2513958, fQOP=0x0, pMessage=0x2544814, MessageSeqNo=0x0 | out: pMessage=0x2544814) returned 0x0 [0224.046] WSASend (in: s=0x32c, lpBuffers=0x25448f0*=((len=0x3ff5, buf=0x2540780*)), dwBufferCount=0x1, lpNumberOfBytesSent=0x6d1ee48, dwFlags=0x0, lpOverlapped=0x250f254, lpCompletionRoutine=0x0 | out: lpNumberOfBytesSent=0x6d1ee48*=0x0, lpOverlapped=0x250f254) returned 0 [0224.063] EncryptMessage (in: phContext=0x2513958, fQOP=0x0, pMessage=0x2548a28, MessageSeqNo=0x0 | out: pMessage=0x2548a28) returned 0x0 [0224.063] WSASend (in: s=0x32c, lpBuffers=0x2548b04*=((len=0x3ff5, buf=0x2544994*)), dwBufferCount=0x1, lpNumberOfBytesSent=0x6d1ee48, dwFlags=0x0, lpOverlapped=0x250f254, lpCompletionRoutine=0x0 | out: lpNumberOfBytesSent=0x6d1ee48*=0x0, lpOverlapped=0x250f254) returned 0 [0224.080] EncryptMessage (in: phContext=0x2513958, fQOP=0x0, pMessage=0x254cc3c, MessageSeqNo=0x0 | out: pMessage=0x254cc3c) returned 0x0 [0224.080] WSASend (in: s=0x32c, lpBuffers=0x254cd18*=((len=0x3ff5, buf=0x2548ba8*)), dwBufferCount=0x1, lpNumberOfBytesSent=0x6d1ee48, dwFlags=0x0, lpOverlapped=0x250f254, lpCompletionRoutine=0x0 | out: lpNumberOfBytesSent=0x6d1ee48*=0x3ff5, lpOverlapped=0x250f254) returned 0 [0224.081] EncryptMessage (in: phContext=0x2513958, fQOP=0x0, pMessage=0x2550e50, MessageSeqNo=0x0 | out: pMessage=0x2550e50) returned 0x0 [0224.082] WSASend (in: s=0x32c, lpBuffers=0x2550f2c*=((len=0x3ff5, buf=0x254cdbc*)), dwBufferCount=0x1, lpNumberOfBytesSent=0x6d1ee48, dwFlags=0x0, lpOverlapped=0x250f254, lpCompletionRoutine=0x0 | out: lpNumberOfBytesSent=0x6d1ee48*=0x3ff5, lpOverlapped=0x250f254) returned 0 [0224.082] EncryptMessage (in: phContext=0x2513958, fQOP=0x0, pMessage=0x2555064, MessageSeqNo=0x0 | out: pMessage=0x2555064) returned 0x0 [0224.083] WSASend (in: s=0x32c, lpBuffers=0x2555140*=((len=0x3ff5, buf=0x2550fd0*)), dwBufferCount=0x1, lpNumberOfBytesSent=0x6d1ee48, dwFlags=0x0, lpOverlapped=0x250f254, lpCompletionRoutine=0x0 | out: lpNumberOfBytesSent=0x6d1ee48*=0x3ff5, lpOverlapped=0x250f254) returned 0 [0224.083] EncryptMessage (in: phContext=0x2513958, fQOP=0x0, pMessage=0x2559278, MessageSeqNo=0x0 | out: pMessage=0x2559278) returned 0x0 [0224.083] WSASend (in: s=0x32c, lpBuffers=0x2559354*=((len=0x3ff5, buf=0x25551e4*)), dwBufferCount=0x1, lpNumberOfBytesSent=0x6d1ee48, dwFlags=0x0, lpOverlapped=0x250f254, lpCompletionRoutine=0x0 | out: lpNumberOfBytesSent=0x6d1ee48*=0x3ff5, lpOverlapped=0x250f254) returned 0 [0224.084] EncryptMessage (in: phContext=0x2513958, fQOP=0x0, pMessage=0x25598d8, MessageSeqNo=0x0 | out: pMessage=0x25598d8) returned 0x0 [0224.084] WSASend (in: s=0x32c, lpBuffers=0x25599b4*=((len=0x445, buf=0x25593f8*)), dwBufferCount=0x1, lpNumberOfBytesSent=0x6d1ee48, dwFlags=0x0, lpOverlapped=0x250f254, lpCompletionRoutine=0x0 | out: lpNumberOfBytesSent=0x6d1ee48*=0x445, lpOverlapped=0x250f254) returned 0 [0224.084] EncryptMessage (in: phContext=0x2513958, fQOP=0x0, pMessage=0x2559d70, MessageSeqNo=0x0 | out: pMessage=0x2559d70) returned 0x0 [0224.084] WSASend (in: s=0x32c, lpBuffers=0x2559e4c*=((len=0x55, buf=0x2559c84*)), dwBufferCount=0x1, lpNumberOfBytesSent=0x6d1e53c, dwFlags=0x0, lpOverlapped=0x250f254, lpCompletionRoutine=0x0 | out: lpNumberOfBytesSent=0x6d1e53c*=0x55, lpOverlapped=0x250f254) returned 0 [0224.605] WSARecv (in: s=0x32c, lpBuffers=0x255a060, dwBufferCount=0x1, lpNumberOfBytesRecvd=0x6d1ee14, lpFlags=0x6d1ee44*=0x0, lpOverlapped=0x250f208, lpCompletionRoutine=0x0 | out: lpBuffers=0x255a060*=((len=0x570, buf=0x252b30d*)), lpNumberOfBytesRecvd=0x6d1ee14*=0x570, lpFlags=0x6d1ee44*=0x0, lpOverlapped=0x250f208) returned 0 [0224.605] DecryptMessage (in: phContext=0x2513958, pMessage=0x255a154, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x255a154, pfQOP=0x0) returned 0x0 [0224.631] WSARecv (in: s=0x32c, lpBuffers=0x255fdb8, dwBufferCount=0x1, lpNumberOfBytesRecvd=0x6d1e554, lpFlags=0x6d1e584*=0x0, lpOverlapped=0x250f208, lpCompletionRoutine=0x0 | out: lpBuffers=0x255fdb8*=((len=0x5, buf=0x252b308*)), lpNumberOfBytesRecvd=0x6d1e554*=0x5, lpFlags=0x6d1e584*=0x0, lpOverlapped=0x250f208) returned 0 [0224.631] WSARecv (in: s=0x32c, lpBuffers=0x255ff14, dwBufferCount=0x1, lpNumberOfBytesRecvd=0x6d1ee14, lpFlags=0x6d1ee44*=0x0, lpOverlapped=0x250f208, lpCompletionRoutine=0x0 | out: lpBuffers=0x255ff14*=((len=0x300, buf=0x252b30d*)), lpNumberOfBytesRecvd=0x6d1ee14*=0x300, lpFlags=0x6d1ee44*=0x0, lpOverlapped=0x250f208) returned 0 [0224.631] DecryptMessage (in: phContext=0x2513958, pMessage=0x2560008, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2560008, pfQOP=0x0) returned 0x0 [0224.632] WSARecv (in: s=0x32c, lpBuffers=0x256065c, dwBufferCount=0x1, lpNumberOfBytesRecvd=0x6d1eaa0, lpFlags=0x6d1ead0*=0x0, lpOverlapped=0x250f208, lpCompletionRoutine=0x0 | out: lpBuffers=0x256065c*=((len=0x5, buf=0x252b308*)), lpNumberOfBytesRecvd=0x6d1eaa0*=0x5, lpFlags=0x6d1ead0*=0x0, lpOverlapped=0x250f208) returned 0 [0224.632] WSARecv (in: s=0x32c, lpBuffers=0x2560718, dwBufferCount=0x1, lpNumberOfBytesRecvd=0x6d1ee14, lpFlags=0x6d1ee44*=0x0, lpOverlapped=0x250f208, lpCompletionRoutine=0x0 | out: lpBuffers=0x2560718*=((len=0x20, buf=0x252b30d*)), lpNumberOfBytesRecvd=0x6d1ee14*=0x20, lpFlags=0x6d1ee44*=0x0, lpOverlapped=0x250f208) returned 0 [0224.632] DecryptMessage (in: phContext=0x2513958, pMessage=0x256080c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x256080c, pfQOP=0x0) returned 0x0 Thread: id = 194 os_tid = 0x778 Thread: id = 195 os_tid = 0x734 Thread: id = 196 os_tid = 0x614 [0224.627] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0224.627] CoGetContextToken (in: pToken=0x733f0dc | out: pToken=0x733f0dc) returned 0x0 [0224.627] IUnknown:QueryInterface (in: This=0x98faa0, riid=0x7463d8c4*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x733f100 | out: ppvObject=0x733f100*=0x98faac) returned 0x0 [0224.645] IComThreadingInfo:GetCurrentThreadType (in: This=0x98faac, pThreadType=0x733f12c | out: pThreadType=0x733f12c*=0) returned 0x0 [0224.645] IUnknown:Release (This=0x98faac) returned 0x1 [0224.646] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0224.646] CoUninitialize () Process: id = "15" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0xd0dc000" os_pid = "0x654" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "14" os_parent_pid = "0x460" cmd_line = "\"cmd.exe\" /C chcp 65001 && netsh wlan show profile | findstr All" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ef13" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 96 os_tid = 0x6a4 [0195.598] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x16f9ec | out: lpSystemTimeAsFileTime=0x16f9ec*(dwLowDateTime=0x42e12df0, dwHighDateTime=0x1d69aeb)) [0195.598] GetCurrentProcessId () returned 0x654 [0195.598] GetCurrentThreadId () returned 0x6a4 [0195.598] GetTickCount () returned 0x1139637 [0195.598] QueryPerformanceCounter (in: lpPerformanceCount=0x16f9e4 | out: lpPerformanceCount=0x16f9e4*=10485860813) returned 1 [0195.599] GetModuleHandleA (lpModuleName=0x0) returned 0x4a5a0000 [0195.599] __set_app_type (_Type=0x1) [0195.599] __p__fmode () returned 0x76a131f4 [0195.604] __p__commode () returned 0x76a131fc [0195.604] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a5c21a6) returned 0x0 [0195.604] __getmainargs (in: _Argc=0x4a5c4238, _Argv=0x4a5c4240, _Env=0x4a5c423c, _DoWildCard=0, _StartInfo=0x4a5c4140 | out: _Argc=0x4a5c4238, _Argv=0x4a5c4240, _Env=0x4a5c423c) returned 0 [0195.605] GetCurrentThreadId () returned 0x6a4 [0195.605] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x6a4) returned 0x60 [0195.605] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76a20000 [0195.605] GetProcAddress (hModule=0x76a20000, lpProcName="SetThreadUILanguage") returned 0x76a4a84f [0195.605] SetThreadUILanguage (LangId=0x0) returned 0x409 [0195.626] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0195.626] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x16f97c | out: phkResult=0x16f97c*=0x0) returned 0x2 [0195.627] VirtualQuery (in: lpAddress=0x16f9b3, lpBuffer=0x16f94c, dwLength=0x1c | out: lpBuffer=0x16f94c*(BaseAddress=0x16f000, AllocationBase=0x70000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0195.627] VirtualQuery (in: lpAddress=0x70000, lpBuffer=0x16f94c, dwLength=0x1c | out: lpBuffer=0x16f94c*(BaseAddress=0x70000, AllocationBase=0x70000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0195.627] VirtualQuery (in: lpAddress=0x71000, lpBuffer=0x16f94c, dwLength=0x1c | out: lpBuffer=0x16f94c*(BaseAddress=0x71000, AllocationBase=0x70000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0195.627] VirtualQuery (in: lpAddress=0x73000, lpBuffer=0x16f94c, dwLength=0x1c | out: lpBuffer=0x16f94c*(BaseAddress=0x73000, AllocationBase=0x70000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0195.627] VirtualQuery (in: lpAddress=0x170000, lpBuffer=0x16f94c, dwLength=0x1c | out: lpBuffer=0x16f94c*(BaseAddress=0x170000, AllocationBase=0x170000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x4, Type=0x40000)) returned 0x1c [0195.627] GetConsoleOutputCP () returned 0x1b5 [0195.627] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a5c4260 | out: lpCPInfo=0x4a5c4260) returned 1 [0195.627] SetConsoleCtrlHandler (HandlerRoutine=0x4a5be72a, Add=1) returned 1 [0195.627] _get_osfhandle (_FileHandle=1) returned 0x3f0 [0195.627] SetConsoleMode (hConsoleHandle=0x3f0, dwMode=0x0) returned 0 [0195.627] _get_osfhandle (_FileHandle=1) returned 0x3f0 [0195.627] GetConsoleMode (in: hConsoleHandle=0x3f0, lpMode=0x4a5c41ac | out: lpMode=0x4a5c41ac) returned 0 [0195.627] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0195.628] GetConsoleMode (in: hConsoleHandle=0xfffffffe, lpMode=0x4a5c41b0 | out: lpMode=0x4a5c41b0) returned 1 [0195.628] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0195.628] SetConsoleMode (hConsoleHandle=0xfffffffe, dwMode=0x7) returned 0 [0195.629] GetEnvironmentStringsW () returned 0x5e20d0* [0195.629] GetProcessHeap () returned 0x5d0000 [0195.629] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xb02) returned 0x5e2be0 [0195.629] FreeEnvironmentStringsW (penv=0x5e20d0) returned 1 [0195.629] GetProcessHeap () returned 0x5d0000 [0195.629] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x4) returned 0x5e1870 [0195.629] GetEnvironmentStringsW () returned 0x5e20d0* [0195.629] GetProcessHeap () returned 0x5d0000 [0195.629] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xb02) returned 0x5e36f0 [0195.629] FreeEnvironmentStringsW (penv=0x5e20d0) returned 1 [0195.629] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x16e8ec | out: phkResult=0x16e8ec*=0x68) returned 0x0 [0195.630] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x16e8f4, lpData=0x16e8f8, lpcbData=0x16e8f0*=0x1000 | out: lpType=0x16e8f4*=0x0, lpData=0x16e8f8*=0x0, lpcbData=0x16e8f0*=0x1000) returned 0x2 [0195.630] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x16e8f4, lpData=0x16e8f8, lpcbData=0x16e8f0*=0x1000 | out: lpType=0x16e8f4*=0x4, lpData=0x16e8f8*=0x1, lpcbData=0x16e8f0*=0x4) returned 0x0 [0195.630] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x16e8f4, lpData=0x16e8f8, lpcbData=0x16e8f0*=0x1000 | out: lpType=0x16e8f4*=0x0, lpData=0x16e8f8*=0x1, lpcbData=0x16e8f0*=0x1000) returned 0x2 [0195.630] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x16e8f4, lpData=0x16e8f8, lpcbData=0x16e8f0*=0x1000 | out: lpType=0x16e8f4*=0x4, lpData=0x16e8f8*=0x0, lpcbData=0x16e8f0*=0x4) returned 0x0 [0195.630] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x16e8f4, lpData=0x16e8f8, lpcbData=0x16e8f0*=0x1000 | out: lpType=0x16e8f4*=0x4, lpData=0x16e8f8*=0x40, lpcbData=0x16e8f0*=0x4) returned 0x0 [0195.630] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x16e8f4, lpData=0x16e8f8, lpcbData=0x16e8f0*=0x1000 | out: lpType=0x16e8f4*=0x4, lpData=0x16e8f8*=0x40, lpcbData=0x16e8f0*=0x4) returned 0x0 [0195.630] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x16e8f4, lpData=0x16e8f8, lpcbData=0x16e8f0*=0x1000 | out: lpType=0x16e8f4*=0x0, lpData=0x16e8f8*=0x40, lpcbData=0x16e8f0*=0x1000) returned 0x2 [0195.630] RegCloseKey (hKey=0x68) returned 0x0 [0195.630] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x16e8ec | out: phkResult=0x16e8ec*=0x68) returned 0x0 [0195.630] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x16e8f4, lpData=0x16e8f8, lpcbData=0x16e8f0*=0x1000 | out: lpType=0x16e8f4*=0x0, lpData=0x16e8f8*=0x40, lpcbData=0x16e8f0*=0x1000) returned 0x2 [0195.630] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x16e8f4, lpData=0x16e8f8, lpcbData=0x16e8f0*=0x1000 | out: lpType=0x16e8f4*=0x4, lpData=0x16e8f8*=0x1, lpcbData=0x16e8f0*=0x4) returned 0x0 [0195.630] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x16e8f4, lpData=0x16e8f8, lpcbData=0x16e8f0*=0x1000 | out: lpType=0x16e8f4*=0x0, lpData=0x16e8f8*=0x1, lpcbData=0x16e8f0*=0x1000) returned 0x2 [0195.630] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x16e8f4, lpData=0x16e8f8, lpcbData=0x16e8f0*=0x1000 | out: lpType=0x16e8f4*=0x4, lpData=0x16e8f8*=0x0, lpcbData=0x16e8f0*=0x4) returned 0x0 [0195.630] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x16e8f4, lpData=0x16e8f8, lpcbData=0x16e8f0*=0x1000 | out: lpType=0x16e8f4*=0x4, lpData=0x16e8f8*=0x9, lpcbData=0x16e8f0*=0x4) returned 0x0 [0195.630] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x16e8f4, lpData=0x16e8f8, lpcbData=0x16e8f0*=0x1000 | out: lpType=0x16e8f4*=0x4, lpData=0x16e8f8*=0x9, lpcbData=0x16e8f0*=0x4) returned 0x0 [0195.630] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x16e8f4, lpData=0x16e8f8, lpcbData=0x16e8f0*=0x1000 | out: lpType=0x16e8f4*=0x0, lpData=0x16e8f8*=0x9, lpcbData=0x16e8f0*=0x1000) returned 0x2 [0195.630] RegCloseKey (hKey=0x68) returned 0x0 [0195.631] time (in: timer=0x0 | out: timer=0x0) returned 0x5f7aceb4 [0195.631] srand (_Seed=0x5f7aceb4) [0195.631] GetCommandLineW () returned="\"cmd.exe\" /C chcp 65001 && netsh wlan show profile | findstr All" [0195.631] GetCommandLineW () returned="\"cmd.exe\" /C chcp 65001 && netsh wlan show profile | findstr All" [0195.631] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a5c5260 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0195.631] GetProcessHeap () returned 0x5d0000 [0195.631] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x210) returned 0x5e20d0 [0195.631] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5e20d8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0195.632] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a5d0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0195.632] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a5d0640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0195.632] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a5d0640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0195.632] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0195.632] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0195.632] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0195.632] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0195.632] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0195.632] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0195.632] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0195.632] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0195.632] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0195.632] GetProcessHeap () returned 0x5d0000 [0195.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e2be0 | out: hHeap=0x5d0000) returned 1 [0195.632] GetEnvironmentStringsW () returned 0x5e22e8* [0195.632] GetProcessHeap () returned 0x5d0000 [0195.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xb1a) returned 0x5e4d28 [0195.632] FreeEnvironmentStringsW (penv=0x5e22e8) returned 1 [0195.633] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a5d0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0195.633] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a5d0640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0195.633] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0195.633] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0195.633] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0195.633] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0195.633] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0195.633] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0195.633] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0195.633] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0195.633] GetProcessHeap () returned 0x5d0000 [0195.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x30) returned 0x5e17a0 [0195.633] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x16f6b8 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0195.633] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x104, lpBuffer=0x16f6b8, lpFilePart=0x16f6b4 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x16f6b4*="system32") returned 0x13 [0195.633] GetFileAttributesW (lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0195.633] FindFirstFileW (in: lpFileName="C:\\Windows", lpFindFileData=0x16f434 | out: lpFindFileData=0x16f434*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x5e5850 [0195.633] FindClose (in: hFindFile=0x5e5850 | out: hFindFile=0x5e5850) returned 1 [0195.633] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x16f434 | out: lpFindFileData=0x16f434*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xefd85d60, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xefd85d60, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System32", cAlternateFileName="")) returned 0x5e5850 [0195.634] FindClose (in: hFindFile=0x5e5850 | out: hFindFile=0x5e5850) returned 1 [0195.634] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0195.634] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0195.634] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0195.634] GetProcessHeap () returned 0x5d0000 [0195.634] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4d28 | out: hHeap=0x5d0000) returned 1 [0195.634] GetEnvironmentStringsW () returned 0x5e4200* [0195.634] GetProcessHeap () returned 0x5d0000 [0195.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xb4a) returned 0x5e4d58 [0195.634] FreeEnvironmentStringsW (penv=0x5e4200) returned 1 [0195.634] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a5c5260 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0195.634] GetProcessHeap () returned 0x5d0000 [0195.634] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e17a0 | out: hHeap=0x5d0000) returned 1 [0195.634] GetProcessHeap () returned 0x5d0000 [0195.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x400e) returned 0x5e58b0 [0195.635] GetProcessHeap () returned 0x5d0000 [0195.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x74) returned 0x5e98e0 [0195.635] GetProcessHeap () returned 0x5d0000 [0195.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e58b0 | out: hHeap=0x5d0000) returned 1 [0195.635] GetConsoleOutputCP () returned 0x1b5 [0195.635] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a5c4260 | out: lpCPInfo=0x4a5c4260) returned 1 [0195.635] GetUserDefaultLCID () returned 0x409 [0195.636] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a5c4950, cchData=8 | out: lpLCData=":") returned 2 [0195.636] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x16f7f8, cchData=128 | out: lpLCData="0") returned 2 [0195.636] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x16f7f8, cchData=128 | out: lpLCData="0") returned 2 [0195.636] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x16f7f8, cchData=128 | out: lpLCData="1") returned 2 [0195.636] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a5c4940, cchData=8 | out: lpLCData="/") returned 2 [0195.636] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a5c4d80, cchData=32 | out: lpLCData="Mon") returned 4 [0195.636] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a5c4d40, cchData=32 | out: lpLCData="Tue") returned 4 [0195.636] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a5c4d00, cchData=32 | out: lpLCData="Wed") returned 4 [0195.636] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a5c4cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0195.636] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a5c4c80, cchData=32 | out: lpLCData="Fri") returned 4 [0195.636] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a5c4c40, cchData=32 | out: lpLCData="Sat") returned 4 [0195.636] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a5c4c00, cchData=32 | out: lpLCData="Sun") returned 4 [0195.636] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a5c4930, cchData=8 | out: lpLCData=".") returned 2 [0195.636] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a5c4920, cchData=8 | out: lpLCData=",") returned 2 [0195.636] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0195.637] GetProcessHeap () returned 0x5d0000 [0195.638] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20c) returned 0x5e2e40 [0195.638] GetConsoleTitleW (in: lpConsoleTitle=0x5e2e40, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0195.638] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76a20000 [0195.638] GetProcAddress (hModule=0x76a20000, lpProcName="CopyFileExW") returned 0x76a53b92 [0195.638] GetProcAddress (hModule=0x76a20000, lpProcName="IsDebuggerPresent") returned 0x76a34a5d [0195.638] GetProcAddress (hModule=0x76a20000, lpProcName="SetConsoleInputExeNameW") returned 0x76a4a79d [0195.639] GetProcessHeap () returned 0x5d0000 [0195.639] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x400a) returned 0x5e58b0 [0195.639] GetProcessHeap () returned 0x5d0000 [0195.639] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e58b0 | out: hHeap=0x5d0000) returned 1 [0195.639] _wcsicmp (_String1="chcp", _String2=")") returned 58 [0195.639] _wcsicmp (_String1="FOR", _String2="chcp") returned 3 [0195.639] _wcsicmp (_String1="FOR/?", _String2="chcp") returned 3 [0195.639] _wcsicmp (_String1="IF", _String2="chcp") returned 6 [0195.639] _wcsicmp (_String1="IF/?", _String2="chcp") returned 6 [0195.639] _wcsicmp (_String1="REM", _String2="chcp") returned 15 [0195.639] _wcsicmp (_String1="REM/?", _String2="chcp") returned 15 [0195.640] GetProcessHeap () returned 0x5d0000 [0195.640] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x58) returned 0x5e3058 [0195.640] GetProcessHeap () returned 0x5d0000 [0195.640] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x12) returned 0x5e17d8 [0195.640] GetProcessHeap () returned 0x5d0000 [0195.640] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x18) returned 0x5e30b8 [0195.641] GetProcessHeap () returned 0x5d0000 [0195.641] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x58) returned 0x5e30d8 [0195.641] _wcsicmp (_String1="FOR", _String2="netsh") returned -8 [0195.641] _wcsicmp (_String1="FOR/?", _String2="netsh") returned -8 [0195.641] _wcsicmp (_String1="IF", _String2="netsh") returned -5 [0195.641] _wcsicmp (_String1="IF/?", _String2="netsh") returned -5 [0195.641] _wcsicmp (_String1="REM", _String2="netsh") returned 4 [0195.641] _wcsicmp (_String1="REM/?", _String2="netsh") returned 4 [0195.641] GetProcessHeap () returned 0x5d0000 [0195.641] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x58) returned 0x5e3138 [0195.642] GetProcessHeap () returned 0x5d0000 [0195.642] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x14) returned 0x5e3198 [0195.642] GetProcessHeap () returned 0x5d0000 [0195.642] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x30) returned 0x5e31b8 [0195.642] GetProcessHeap () returned 0x5d0000 [0195.642] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x58) returned 0x5e31f0 [0195.643] _wcsicmp (_String1="FOR", _String2="findstr") returned 6 [0195.643] _wcsicmp (_String1="FOR/?", _String2="findstr") returned 6 [0195.643] _wcsicmp (_String1="IF", _String2="findstr") returned 3 [0195.643] _wcsicmp (_String1="IF/?", _String2="findstr") returned 3 [0195.643] _wcsicmp (_String1="REM", _String2="findstr") returned 12 [0195.643] _wcsicmp (_String1="REM/?", _String2="findstr") returned 12 [0195.643] GetProcessHeap () returned 0x5d0000 [0195.643] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x58) returned 0x5e3250 [0195.643] GetProcessHeap () returned 0x5d0000 [0195.643] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x18) returned 0x5e32b0 [0195.643] GetProcessHeap () returned 0x5d0000 [0195.643] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x12) returned 0x5e32d0 [0195.644] GetConsoleTitleW (in: lpConsoleTitle=0x16f48c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0195.644] _wcsicmp (_String1="chcp", _String2="DIR") returned -1 [0195.644] _wcsicmp (_String1="chcp", _String2="ERASE") returned -2 [0195.644] _wcsicmp (_String1="chcp", _String2="DEL") returned -1 [0195.644] _wcsicmp (_String1="chcp", _String2="TYPE") returned -17 [0195.645] _wcsicmp (_String1="chcp", _String2="COPY") returned -7 [0195.645] _wcsicmp (_String1="chcp", _String2="CD") returned 4 [0195.645] _wcsicmp (_String1="chcp", _String2="CHDIR") returned -1 [0195.645] _wcsicmp (_String1="chcp", _String2="RENAME") returned -15 [0195.645] _wcsicmp (_String1="chcp", _String2="REN") returned -15 [0195.645] _wcsicmp (_String1="chcp", _String2="ECHO") returned -2 [0195.645] _wcsicmp (_String1="chcp", _String2="SET") returned -16 [0195.645] _wcsicmp (_String1="chcp", _String2="PAUSE") returned -13 [0195.645] _wcsicmp (_String1="chcp", _String2="DATE") returned -1 [0195.645] _wcsicmp (_String1="chcp", _String2="TIME") returned -17 [0195.645] _wcsicmp (_String1="chcp", _String2="PROMPT") returned -13 [0195.645] _wcsicmp (_String1="chcp", _String2="MD") returned -10 [0195.645] _wcsicmp (_String1="chcp", _String2="MKDIR") returned -10 [0195.645] _wcsicmp (_String1="chcp", _String2="RD") returned -15 [0195.645] _wcsicmp (_String1="chcp", _String2="RMDIR") returned -15 [0195.645] _wcsicmp (_String1="chcp", _String2="PATH") returned -13 [0195.645] _wcsicmp (_String1="chcp", _String2="GOTO") returned -4 [0195.645] _wcsicmp (_String1="chcp", _String2="SHIFT") returned -16 [0195.645] _wcsicmp (_String1="chcp", _String2="CLS") returned -4 [0195.645] _wcsicmp (_String1="chcp", _String2="CALL") returned 7 [0195.645] _wcsicmp (_String1="chcp", _String2="VERIFY") returned -19 [0195.645] _wcsicmp (_String1="chcp", _String2="VER") returned -19 [0195.645] _wcsicmp (_String1="chcp", _String2="VOL") returned -19 [0195.645] _wcsicmp (_String1="chcp", _String2="EXIT") returned -2 [0195.645] _wcsicmp (_String1="chcp", _String2="SETLOCAL") returned -16 [0195.645] _wcsicmp (_String1="chcp", _String2="ENDLOCAL") returned -2 [0195.645] _wcsicmp (_String1="chcp", _String2="TITLE") returned -17 [0195.645] _wcsicmp (_String1="chcp", _String2="START") returned -16 [0195.645] _wcsicmp (_String1="chcp", _String2="DPATH") returned -1 [0195.645] _wcsicmp (_String1="chcp", _String2="KEYS") returned -8 [0195.645] _wcsicmp (_String1="chcp", _String2="MOVE") returned -10 [0195.645] _wcsicmp (_String1="chcp", _String2="PUSHD") returned -13 [0195.645] _wcsicmp (_String1="chcp", _String2="POPD") returned -13 [0195.645] _wcsicmp (_String1="chcp", _String2="ASSOC") returned 2 [0195.645] _wcsicmp (_String1="chcp", _String2="FTYPE") returned -3 [0195.645] _wcsicmp (_String1="chcp", _String2="BREAK") returned 1 [0195.646] _wcsicmp (_String1="chcp", _String2="COLOR") returned -7 [0195.646] _wcsicmp (_String1="chcp", _String2="MKLINK") returned -10 [0195.646] _wcsicmp (_String1="chcp", _String2="DIR") returned -1 [0195.646] _wcsicmp (_String1="chcp", _String2="ERASE") returned -2 [0195.646] _wcsicmp (_String1="chcp", _String2="DEL") returned -1 [0195.646] _wcsicmp (_String1="chcp", _String2="TYPE") returned -17 [0195.646] _wcsicmp (_String1="chcp", _String2="COPY") returned -7 [0195.646] _wcsicmp (_String1="chcp", _String2="CD") returned 4 [0195.646] _wcsicmp (_String1="chcp", _String2="CHDIR") returned -1 [0195.646] _wcsicmp (_String1="chcp", _String2="RENAME") returned -15 [0195.646] _wcsicmp (_String1="chcp", _String2="REN") returned -15 [0195.646] _wcsicmp (_String1="chcp", _String2="ECHO") returned -2 [0195.646] _wcsicmp (_String1="chcp", _String2="SET") returned -16 [0195.646] _wcsicmp (_String1="chcp", _String2="PAUSE") returned -13 [0195.646] _wcsicmp (_String1="chcp", _String2="DATE") returned -1 [0195.646] _wcsicmp (_String1="chcp", _String2="TIME") returned -17 [0195.646] _wcsicmp (_String1="chcp", _String2="PROMPT") returned -13 [0195.646] _wcsicmp (_String1="chcp", _String2="MD") returned -10 [0195.646] _wcsicmp (_String1="chcp", _String2="MKDIR") returned -10 [0195.646] _wcsicmp (_String1="chcp", _String2="RD") returned -15 [0195.646] _wcsicmp (_String1="chcp", _String2="RMDIR") returned -15 [0195.646] _wcsicmp (_String1="chcp", _String2="PATH") returned -13 [0195.646] _wcsicmp (_String1="chcp", _String2="GOTO") returned -4 [0195.646] _wcsicmp (_String1="chcp", _String2="SHIFT") returned -16 [0195.646] _wcsicmp (_String1="chcp", _String2="CLS") returned -4 [0195.646] _wcsicmp (_String1="chcp", _String2="CALL") returned 7 [0195.646] _wcsicmp (_String1="chcp", _String2="VERIFY") returned -19 [0195.646] _wcsicmp (_String1="chcp", _String2="VER") returned -19 [0195.646] _wcsicmp (_String1="chcp", _String2="VOL") returned -19 [0195.646] _wcsicmp (_String1="chcp", _String2="EXIT") returned -2 [0195.646] _wcsicmp (_String1="chcp", _String2="SETLOCAL") returned -16 [0195.646] _wcsicmp (_String1="chcp", _String2="ENDLOCAL") returned -2 [0195.646] _wcsicmp (_String1="chcp", _String2="TITLE") returned -17 [0195.646] _wcsicmp (_String1="chcp", _String2="START") returned -16 [0195.647] _wcsicmp (_String1="chcp", _String2="DPATH") returned -1 [0195.647] _wcsicmp (_String1="chcp", _String2="KEYS") returned -8 [0195.647] _wcsicmp (_String1="chcp", _String2="MOVE") returned -10 [0195.647] _wcsicmp (_String1="chcp", _String2="PUSHD") returned -13 [0195.647] _wcsicmp (_String1="chcp", _String2="POPD") returned -13 [0195.647] _wcsicmp (_String1="chcp", _String2="ASSOC") returned 2 [0195.647] _wcsicmp (_String1="chcp", _String2="FTYPE") returned -3 [0195.647] _wcsicmp (_String1="chcp", _String2="BREAK") returned 1 [0195.647] _wcsicmp (_String1="chcp", _String2="COLOR") returned -7 [0195.647] _wcsicmp (_String1="chcp", _String2="MKLINK") returned -10 [0195.647] _wcsicmp (_String1="chcp", _String2="FOR") returned -3 [0195.647] _wcsicmp (_String1="chcp", _String2="IF") returned -6 [0195.647] _wcsicmp (_String1="chcp", _String2="REM") returned -15 [0195.647] GetProcessHeap () returned 0x5d0000 [0195.647] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x210) returned 0x5e32f0 [0195.647] GetProcessHeap () returned 0x5d0000 [0195.647] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x22) returned 0x5e3508 [0195.647] _wcsnicmp (_String1="chcp", _String2="cmd ", _MaxCount=0x4) returned -5 [0195.647] GetProcessHeap () returned 0x5d0000 [0195.647] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x418) returned 0x5d07f0 [0195.647] SetErrorMode (uMode=0x0) returned 0x0 [0195.647] SetErrorMode (uMode=0x1) returned 0x0 [0195.648] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x5d07f8, lpFilePart=0x16efac | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x16efac*="system32") returned 0x13 [0195.648] SetErrorMode (uMode=0x0) returned 0x1 [0195.648] GetProcessHeap () returned 0x5d0000 [0195.648] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5d07f0, Size=0x3a) returned 0x5d07f0 [0195.648] GetProcessHeap () returned 0x5d0000 [0195.648] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x5d07f0) returned 0x3a [0195.648] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a5d0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0195.648] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0195.648] GetProcessHeap () returned 0x5d0000 [0195.648] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xfc) returned 0x5e3538 [0195.648] GetProcessHeap () returned 0x5d0000 [0195.648] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x1f0) returned 0x5d0838 [0195.654] GetProcessHeap () returned 0x5d0000 [0195.654] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5d0838, Size=0xfe) returned 0x5d0838 [0195.654] GetProcessHeap () returned 0x5d0000 [0195.654] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x5d0838) returned 0xfe [0195.654] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a5d0640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0195.654] GetProcessHeap () returned 0x5d0000 [0195.654] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xe0) returned 0x5d0940 [0195.654] GetProcessHeap () returned 0x5d0000 [0195.654] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5d0940, Size=0x76) returned 0x5d0940 [0195.654] GetProcessHeap () returned 0x5d0000 [0195.654] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x5d0940) returned 0x76 [0195.657] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0195.657] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\chcp.*", fInfoLevelId=0x1, lpFindFileData=0x16ed28, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16ed28) returned 0x5e3640 [0195.657] GetProcessHeap () returned 0x5d0000 [0195.657] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x14) returned 0x5e3680 [0195.657] FindClose (in: hFindFile=0x5e3640 | out: hFindFile=0x5e3640) returned 1 [0195.657] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\chcp.COM", fInfoLevelId=0x1, lpFindFileData=0x16ed28, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16ed28) returned 0x5e3640 [0195.657] GetProcessHeap () returned 0x5d0000 [0195.657] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e3680, Size=0x4) returned 0x5e3680 [0195.657] FindClose (in: hFindFile=0x5e3640 | out: hFindFile=0x5e3640) returned 1 [0195.657] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0195.658] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0195.658] GetConsoleTitleW (in: lpConsoleTitle=0x16f220, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0195.658] InitializeProcThreadAttributeList (in: lpAttributeList=0x16f0a8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x16f170 | out: lpAttributeList=0x16f0a8, lpSize=0x16f170) returned 1 [0195.658] UpdateProcThreadAttribute (in: lpAttributeList=0x16f0a8, dwFlags=0x0, Attribute=0x60001, lpValue=0x16f168, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x16f0a8, lpPreviousValue=0x0) returned 1 [0195.658] GetStartupInfoW (in: lpStartupInfo=0x16f064 | out: lpStartupInfo=0x16f064*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x3f0, hStdError=0x3f8)) [0195.658] GetProcessHeap () returned 0x5d0000 [0195.658] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x18) returned 0x5e3640 [0195.658] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0195.658] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0195.658] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0195.658] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0195.658] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0195.658] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0195.658] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0195.658] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0195.658] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0195.658] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0195.658] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0195.658] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0195.658] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0195.658] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0195.658] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0195.658] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0195.658] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0195.659] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0195.659] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0195.659] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0195.659] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0195.659] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0195.659] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0195.659] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0195.659] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0195.659] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0195.659] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0195.659] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0195.659] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0195.659] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0195.659] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0195.659] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0195.659] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0195.659] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0195.659] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0195.659] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0195.659] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0195.659] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0195.659] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0195.659] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0195.659] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0195.659] GetProcessHeap () returned 0x5d0000 [0195.659] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e3640 | out: hHeap=0x5d0000) returned 1 [0195.659] GetProcessHeap () returned 0x5d0000 [0195.659] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xa) returned 0x5dff98 [0195.659] lstrcmpW (lpString1="\\chcp.com", lpString2="\\XCOPY.EXE") returned -1 [0195.661] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\chcp.com", lpCommandLine="chcp 65001 ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x16f104*(cb=0x48, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="chcp 65001 ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x16f150 | out: lpCommandLine="chcp 65001 ", lpProcessInformation=0x16f150*(hProcess=0x78, hThread=0x74, dwProcessId=0x6c0, dwThreadId=0x328)) returned 1 [0195.793] CloseHandle (hObject=0x74) returned 1 [0195.793] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0195.793] GetProcessHeap () returned 0x5d0000 [0195.793] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4d58 | out: hHeap=0x5d0000) returned 1 [0195.793] GetEnvironmentStringsW () returned 0x5eb8c8* [0195.793] GetProcessHeap () returned 0x5d0000 [0195.793] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xb4a) returned 0x5ec420 [0195.793] FreeEnvironmentStringsW (penv=0x5eb8c8) returned 1 [0195.793] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0195.867] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x16f044 | out: lpExitCode=0x16f044*=0x0) returned 1 [0195.868] CloseHandle (hObject=0x78) returned 1 [0195.868] _vsnwprintf (in: _Buffer=0x16f18c, _BufferCount=0x13, _Format="%08X", _ArgList=0x16f050 | out: _Buffer="00000000") returned 8 [0195.868] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0195.868] GetProcessHeap () returned 0x5d0000 [0195.868] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ec420 | out: hHeap=0x5d0000) returned 1 [0195.868] GetEnvironmentStringsW () returned 0x5eb8c8* [0195.868] GetProcessHeap () returned 0x5d0000 [0195.868] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xb70) returned 0x5ec440 [0195.868] FreeEnvironmentStringsW (penv=0x5eb8c8) returned 1 [0195.868] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0195.868] GetProcessHeap () returned 0x5d0000 [0195.868] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ec440 | out: hHeap=0x5d0000) returned 1 [0195.868] GetEnvironmentStringsW () returned 0x5eb8c8* [0195.868] GetProcessHeap () returned 0x5d0000 [0195.868] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xb70) returned 0x5ec440 [0195.868] FreeEnvironmentStringsW (penv=0x5eb8c8) returned 1 [0195.868] GetProcessHeap () returned 0x5d0000 [0195.868] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5dff98 | out: hHeap=0x5d0000) returned 1 [0195.868] DeleteProcThreadAttributeList (in: lpAttributeList=0x16f0a8 | out: lpAttributeList=0x16f0a8) [0195.868] GetProcessHeap () returned 0x5d0000 [0195.868] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x30) returned 0x5e3690 [0195.868] _pipe (in: _PtHandles=0x5e3698, _PipeSize=0x0, _TextMode=32768 | out: _PtHandles=0x5e3698) returned 0 [0195.869] _dup (_FileHandle=1) returned 5 [0195.869] _dup2 (_FileHandleSrc=4, _FileHandleDst=1) returned 0 [0195.869] _close (_FileHandle=4) returned 0 [0195.869] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x4008) returned 0x5e4ee8 [0195.869] _wcsicmp (_String1="netsh", _String2="DIR") returned 10 [0195.869] _wcsicmp (_String1="netsh", _String2="ERASE") returned 9 [0195.869] _wcsicmp (_String1="netsh", _String2="DEL") returned 10 [0195.869] _wcsicmp (_String1="netsh", _String2="TYPE") returned -6 [0195.869] _wcsicmp (_String1="netsh", _String2="COPY") returned 11 [0195.869] _wcsicmp (_String1="netsh", _String2="CD") returned 11 [0195.869] _wcsicmp (_String1="netsh", _String2="CHDIR") returned 11 [0195.869] _wcsicmp (_String1="netsh", _String2="RENAME") returned -4 [0195.869] _wcsicmp (_String1="netsh", _String2="REN") returned -4 [0195.869] _wcsicmp (_String1="netsh", _String2="ECHO") returned 9 [0195.869] _wcsicmp (_String1="netsh", _String2="SET") returned -5 [0195.869] _wcsicmp (_String1="netsh", _String2="PAUSE") returned -2 [0195.869] _wcsicmp (_String1="netsh", _String2="DATE") returned 10 [0195.869] _wcsicmp (_String1="netsh", _String2="TIME") returned -6 [0195.869] _wcsicmp (_String1="netsh", _String2="PROMPT") returned -2 [0195.869] _wcsicmp (_String1="netsh", _String2="MD") returned 1 [0195.869] _wcsicmp (_String1="netsh", _String2="MKDIR") returned 1 [0195.870] _wcsicmp (_String1="netsh", _String2="RD") returned -4 [0195.870] _wcsicmp (_String1="netsh", _String2="RMDIR") returned -4 [0195.870] _wcsicmp (_String1="netsh", _String2="PATH") returned -2 [0195.870] _wcsicmp (_String1="netsh", _String2="GOTO") returned 7 [0195.870] _wcsicmp (_String1="netsh", _String2="SHIFT") returned -5 [0195.870] _wcsicmp (_String1="netsh", _String2="CLS") returned 11 [0195.870] _wcsicmp (_String1="netsh", _String2="CALL") returned 11 [0195.870] _wcsicmp (_String1="netsh", _String2="VERIFY") returned -8 [0195.870] _wcsicmp (_String1="netsh", _String2="VER") returned -8 [0195.870] _wcsicmp (_String1="netsh", _String2="VOL") returned -8 [0195.870] _wcsicmp (_String1="netsh", _String2="EXIT") returned 9 [0195.870] _wcsicmp (_String1="netsh", _String2="SETLOCAL") returned -5 [0195.870] _wcsicmp (_String1="netsh", _String2="ENDLOCAL") returned 9 [0195.870] _wcsicmp (_String1="netsh", _String2="TITLE") returned -6 [0195.870] _wcsicmp (_String1="netsh", _String2="START") returned -5 [0195.870] _wcsicmp (_String1="netsh", _String2="DPATH") returned 10 [0195.870] _wcsicmp (_String1="netsh", _String2="KEYS") returned 3 [0195.870] _wcsicmp (_String1="netsh", _String2="MOVE") returned 1 [0195.870] _wcsicmp (_String1="netsh", _String2="PUSHD") returned -2 [0195.870] _wcsicmp (_String1="netsh", _String2="POPD") returned -2 [0195.870] _wcsicmp (_String1="netsh", _String2="ASSOC") returned 13 [0195.870] _wcsicmp (_String1="netsh", _String2="FTYPE") returned 8 [0195.870] _wcsicmp (_String1="netsh", _String2="BREAK") returned 12 [0195.870] _wcsicmp (_String1="netsh", _String2="COLOR") returned 11 [0195.870] _wcsicmp (_String1="netsh", _String2="MKLINK") returned 1 [0195.870] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x418) returned 0x5e8ef8 [0195.870] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x5e8f00, lpFilePart=0x16f5f8 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x16f5f8*="system32") returned 0x13 [0195.870] SetErrorMode (uMode=0x0) returned 0x1 [0195.871] GetProcessHeap () returned 0x5d0000 [0195.871] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e8ef8, Size=0x3c) returned 0x5e8ef8 [0195.871] GetProcessHeap () returned 0x5d0000 [0195.871] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x5e8ef8) returned 0x3c [0195.871] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a5d0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0195.871] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0195.871] GetProcessHeap () returned 0x5d0000 [0195.871] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xfc) returned 0x5df348 [0195.871] GetProcessHeap () returned 0x5d0000 [0195.871] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x1f0) returned 0x5e8f40 [0195.871] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e8f40, Size=0xfe) returned 0x5e8f40 [0195.871] GetProcessHeap () returned 0x5d0000 [0195.871] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x5e8f40) returned 0xfe [0195.871] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a5d0640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0195.871] GetProcessHeap () returned 0x5d0000 [0195.871] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xe0) returned 0x5e9048 [0195.871] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e9048, Size=0x76) returned 0x5e9048 [0195.871] GetProcessHeap () returned 0x5d0000 [0195.871] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x5e9048) returned 0x76 [0195.871] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0195.871] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\netsh.*", fInfoLevelId=0x1, lpFindFileData=0x16f374, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16f374) returned 0x5df450 [0195.872] FindClose (in: hFindFile=0x5df450 | out: hFindFile=0x5df450) returned 1 [0195.872] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\netsh.COM", fInfoLevelId=0x1, lpFindFileData=0x16f374, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16f374) returned 0xffffffff [0195.872] GetLastError () returned 0x2 [0195.872] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\netsh.EXE", fInfoLevelId=0x1, lpFindFileData=0x16f374, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16f374) returned 0x5df450 [0195.873] FindClose (in: hFindFile=0x5df450 | out: hFindFile=0x5df450) returned 1 [0195.873] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0195.873] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0195.873] GetProcessHeap () returned 0x5d0000 [0195.873] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x18) returned 0x5e3660 [0195.873] GetProcessHeap () returned 0x5d0000 [0195.873] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x210) returned 0x5e90c8 [0195.873] GetProcessHeap () returned 0x5d0000 [0195.873] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x3c) returned 0x5df450 [0195.873] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x418) returned 0x5e92e0 [0195.873] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x5e92e8, lpFilePart=0x16f3a4 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x16f3a4*="system32") returned 0x13 [0195.873] SetErrorMode (uMode=0x0) returned 0x1 [0195.873] GetProcessHeap () returned 0x5d0000 [0195.873] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e92e0, Size=0x3c) returned 0x5e92e0 [0195.873] GetProcessHeap () returned 0x5d0000 [0195.873] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x5e92e0) returned 0x3c [0195.873] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a5d0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0195.873] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0195.873] GetProcessHeap () returned 0x5d0000 [0195.873] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xfc) returned 0x5e9328 [0195.873] GetProcessHeap () returned 0x5d0000 [0195.873] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x1f0) returned 0x5e9430 [0195.873] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e9430, Size=0xfe) returned 0x5e9430 [0195.873] GetProcessHeap () returned 0x5d0000 [0195.873] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x5e9430) returned 0xfe [0195.873] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a5d0640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0195.873] GetProcessHeap () returned 0x5d0000 [0195.873] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xe0) returned 0x5e9538 [0195.873] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e9538, Size=0x76) returned 0x5e9538 [0195.873] GetProcessHeap () returned 0x5d0000 [0195.874] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x5e9538) returned 0x76 [0195.874] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0195.874] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\netsh.*", fInfoLevelId=0x1, lpFindFileData=0x16f120, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16f120) returned 0x5e95b8 [0195.874] FindClose (in: hFindFile=0x5e95b8 | out: hFindFile=0x5e95b8) returned 1 [0195.874] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\netsh.COM", fInfoLevelId=0x1, lpFindFileData=0x16f120, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16f120) returned 0xffffffff [0195.874] GetLastError () returned 0x2 [0195.874] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\netsh.EXE", fInfoLevelId=0x1, lpFindFileData=0x16f120, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16f120) returned 0x5e95b8 [0195.874] FindClose (in: hFindFile=0x5e95b8 | out: hFindFile=0x5e95b8) returned 1 [0195.874] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0195.874] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0195.874] GetConsoleTitleW (in: lpConsoleTitle=0x16f618, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0195.874] InitializeProcThreadAttributeList (in: lpAttributeList=0x16f4a0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x16f568 | out: lpAttributeList=0x16f4a0, lpSize=0x16f568) returned 1 [0195.874] UpdateProcThreadAttribute (in: lpAttributeList=0x16f4a0, dwFlags=0x0, Attribute=0x60001, lpValue=0x16f560, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x16f4a0, lpPreviousValue=0x0) returned 1 [0195.874] GetStartupInfoW (in: lpStartupInfo=0x16f45c | out: lpStartupInfo=0x16f45c*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x3f0, hStdError=0x3f8)) [0195.875] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x18) returned 0x5df498 [0195.875] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0195.875] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0195.875] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0195.875] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0195.875] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0195.875] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0195.875] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0195.875] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0195.875] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0195.875] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0195.875] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0195.875] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0195.875] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0195.875] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0195.875] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0195.875] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0195.875] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0195.875] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0195.875] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0195.875] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0195.875] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0195.875] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0195.875] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0195.875] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0195.875] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0195.875] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0195.875] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0195.875] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0195.875] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0195.875] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0195.875] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0195.875] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0195.875] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0195.876] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0195.876] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0195.876] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0195.876] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0195.876] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0195.876] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0195.876] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0195.876] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0195.876] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0195.876] GetProcessHeap () returned 0x5d0000 [0195.876] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5df498 | out: hHeap=0x5d0000) returned 1 [0195.876] GetProcessHeap () returned 0x5d0000 [0195.876] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xa) returned 0x5dff98 [0195.876] lstrcmpW (lpString1="\\netsh.exe", lpString2="\\XCOPY.EXE") returned -1 [0195.876] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\netsh.exe", lpCommandLine="netsh wlan show profile ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x16f4fc*(cb=0x48, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="netsh wlan show profile ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x16f548 | out: lpCommandLine="netsh wlan show profile ", lpProcessInformation=0x16f548*(hProcess=0x84, hThread=0x80, dwProcessId=0x330, dwThreadId=0x324)) returned 1 [0195.889] CloseHandle (hObject=0x80) returned 1 [0195.889] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0195.889] GetProcessHeap () returned 0x5d0000 [0195.889] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ec440 | out: hHeap=0x5d0000) returned 1 [0195.889] GetEnvironmentStringsW () returned 0x5eb8c8* [0195.889] GetProcessHeap () returned 0x5d0000 [0195.889] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xb70) returned 0x5ec440 [0195.889] FreeEnvironmentStringsW (penv=0x5eb8c8) returned 1 [0195.889] GetProcessHeap () returned 0x5d0000 [0195.889] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5dff98 | out: hHeap=0x5d0000) returned 1 [0195.889] DeleteProcThreadAttributeList (in: lpAttributeList=0x16f4a0 | out: lpAttributeList=0x16f4a0) [0195.889] _get_osfhandle (_FileHandle=3) returned 0x74 [0195.889] DuplicateHandle (in: hSourceProcessHandle=0x84, hSourceHandle=0x74, hTargetProcessHandle=0x0, lpTargetHandle=0x0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x1 | out: lpTargetHandle=0x0) returned 1 [0195.889] _dup2 (_FileHandleSrc=5, _FileHandleDst=1) returned 0 [0195.889] _close (_FileHandle=5) returned 0 [0195.889] _dup (_FileHandle=0) returned 4 [0195.890] _dup2 (_FileHandleSrc=3, _FileHandleDst=0) returned 0 [0195.890] _close (_FileHandle=3) returned 0 [0195.891] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x4008) returned 0x5ecfb8 [0195.891] _wcsicmp (_String1="findstr", _String2="DIR") returned 2 [0195.891] _wcsicmp (_String1="findstr", _String2="ERASE") returned 1 [0195.891] _wcsicmp (_String1="findstr", _String2="DEL") returned 2 [0195.891] _wcsicmp (_String1="findstr", _String2="TYPE") returned -14 [0195.891] _wcsicmp (_String1="findstr", _String2="COPY") returned 3 [0195.891] _wcsicmp (_String1="findstr", _String2="CD") returned 3 [0195.891] _wcsicmp (_String1="findstr", _String2="CHDIR") returned 3 [0195.891] _wcsicmp (_String1="findstr", _String2="RENAME") returned -12 [0195.891] _wcsicmp (_String1="findstr", _String2="REN") returned -12 [0195.891] _wcsicmp (_String1="findstr", _String2="ECHO") returned 1 [0195.891] _wcsicmp (_String1="findstr", _String2="SET") returned -13 [0195.891] _wcsicmp (_String1="findstr", _String2="PAUSE") returned -10 [0195.891] _wcsicmp (_String1="findstr", _String2="DATE") returned 2 [0195.891] _wcsicmp (_String1="findstr", _String2="TIME") returned -14 [0195.891] _wcsicmp (_String1="findstr", _String2="PROMPT") returned -10 [0195.891] _wcsicmp (_String1="findstr", _String2="MD") returned -7 [0195.891] _wcsicmp (_String1="findstr", _String2="MKDIR") returned -7 [0195.891] _wcsicmp (_String1="findstr", _String2="RD") returned -12 [0195.891] _wcsicmp (_String1="findstr", _String2="RMDIR") returned -12 [0195.891] _wcsicmp (_String1="findstr", _String2="PATH") returned -10 [0195.891] _wcsicmp (_String1="findstr", _String2="GOTO") returned -1 [0195.891] _wcsicmp (_String1="findstr", _String2="SHIFT") returned -13 [0195.891] _wcsicmp (_String1="findstr", _String2="CLS") returned 3 [0195.891] _wcsicmp (_String1="findstr", _String2="CALL") returned 3 [0195.891] _wcsicmp (_String1="findstr", _String2="VERIFY") returned -16 [0195.892] _wcsicmp (_String1="findstr", _String2="VER") returned -16 [0195.892] _wcsicmp (_String1="findstr", _String2="VOL") returned -16 [0195.892] _wcsicmp (_String1="findstr", _String2="EXIT") returned 1 [0195.892] _wcsicmp (_String1="findstr", _String2="SETLOCAL") returned -13 [0195.892] _wcsicmp (_String1="findstr", _String2="ENDLOCAL") returned 1 [0195.892] _wcsicmp (_String1="findstr", _String2="TITLE") returned -14 [0195.892] _wcsicmp (_String1="findstr", _String2="START") returned -13 [0195.892] _wcsicmp (_String1="findstr", _String2="DPATH") returned 2 [0195.892] _wcsicmp (_String1="findstr", _String2="KEYS") returned -5 [0195.892] _wcsicmp (_String1="findstr", _String2="MOVE") returned -7 [0195.892] _wcsicmp (_String1="findstr", _String2="PUSHD") returned -10 [0195.892] _wcsicmp (_String1="findstr", _String2="POPD") returned -10 [0195.892] _wcsicmp (_String1="findstr", _String2="ASSOC") returned 5 [0195.892] _wcsicmp (_String1="findstr", _String2="FTYPE") returned -11 [0195.892] _wcsicmp (_String1="findstr", _String2="BREAK") returned 4 [0195.892] _wcsicmp (_String1="findstr", _String2="COLOR") returned 3 [0195.892] _wcsicmp (_String1="findstr", _String2="MKLINK") returned -7 [0195.892] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x418) returned 0x5e22e8 [0195.892] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x5e22f0, lpFilePart=0x16f5f8 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x16f5f8*="system32") returned 0x13 [0195.892] SetErrorMode (uMode=0x0) returned 0x1 [0195.892] GetProcessHeap () returned 0x5d0000 [0195.892] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e22e8, Size=0x40) returned 0x5e22e8 [0195.892] GetProcessHeap () returned 0x5d0000 [0195.892] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x5e22e8) returned 0x40 [0195.892] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a5d0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0195.892] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0195.892] GetProcessHeap () returned 0x5d0000 [0195.892] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xfc) returned 0x5e95b8 [0195.892] GetProcessHeap () returned 0x5d0000 [0195.892] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x1f0) returned 0x5e96c0 [0195.892] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e96c0, Size=0xfe) returned 0x5e96c0 [0195.892] GetProcessHeap () returned 0x5d0000 [0195.893] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x5e96c0) returned 0xfe [0195.893] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a5d0640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0195.893] GetProcessHeap () returned 0x5d0000 [0195.893] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xe0) returned 0x5e97c8 [0195.893] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e97c8, Size=0x76) returned 0x5e97c8 [0195.893] GetProcessHeap () returned 0x5d0000 [0195.893] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x5e97c8) returned 0x76 [0195.893] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0195.893] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\findstr.*", fInfoLevelId=0x1, lpFindFileData=0x16f374, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16f374) returned 0x5e9848 [0195.894] FindClose (in: hFindFile=0x5e9848 | out: hFindFile=0x5e9848) returned 1 [0195.894] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\findstr.COM", fInfoLevelId=0x1, lpFindFileData=0x16f374, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16f374) returned 0xffffffff [0195.894] GetLastError () returned 0x2 [0195.894] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\findstr.EXE", fInfoLevelId=0x1, lpFindFileData=0x16f374, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16f374) returned 0x5e9848 [0195.894] FindClose (in: hFindFile=0x5e9848 | out: hFindFile=0x5e9848) returned 1 [0195.894] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0195.894] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0195.894] GetProcessHeap () returned 0x5d0000 [0195.894] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x18) returned 0x5df498 [0195.894] GetProcessHeap () returned 0x5d0000 [0195.894] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x210) returned 0x5e2330 [0195.895] GetProcessHeap () returned 0x5d0000 [0195.895] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x22) returned 0x5e9848 [0195.895] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x418) returned 0x5e2548 [0195.895] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x5e2550, lpFilePart=0x16f3a4 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x16f3a4*="system32") returned 0x13 [0195.895] SetErrorMode (uMode=0x0) returned 0x1 [0195.895] GetProcessHeap () returned 0x5d0000 [0195.895] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e2548, Size=0x40) returned 0x5e2548 [0195.895] GetProcessHeap () returned 0x5d0000 [0195.895] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x5e2548) returned 0x40 [0195.895] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a5d0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0195.895] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0195.895] GetProcessHeap () returned 0x5d0000 [0195.895] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xfc) returned 0x5e2590 [0195.895] GetProcessHeap () returned 0x5d0000 [0195.895] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x1f0) returned 0x5e2698 [0195.895] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e2698, Size=0xfe) returned 0x5e2698 [0195.895] GetProcessHeap () returned 0x5d0000 [0195.895] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x5e2698) returned 0xfe [0195.895] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a5d0640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0195.895] GetProcessHeap () returned 0x5d0000 [0195.895] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xe0) returned 0x5e27a0 [0195.895] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e27a0, Size=0x76) returned 0x5e27a0 [0195.895] GetProcessHeap () returned 0x5d0000 [0195.895] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x5e27a0) returned 0x76 [0195.895] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0195.895] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\findstr.*", fInfoLevelId=0x1, lpFindFileData=0x16f120, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16f120) returned 0x5e9878 [0195.895] FindClose (in: hFindFile=0x5e9878 | out: hFindFile=0x5e9878) returned 1 [0195.896] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\findstr.COM", fInfoLevelId=0x1, lpFindFileData=0x16f120, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16f120) returned 0xffffffff [0195.896] GetLastError () returned 0x2 [0195.896] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\findstr.EXE", fInfoLevelId=0x1, lpFindFileData=0x16f120, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16f120) returned 0x5e9878 [0195.896] FindClose (in: hFindFile=0x5e9878 | out: hFindFile=0x5e9878) returned 1 [0195.896] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0195.896] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0195.896] GetConsoleTitleW (in: lpConsoleTitle=0x16f618, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0195.896] InitializeProcThreadAttributeList (in: lpAttributeList=0x16f4a0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x16f568 | out: lpAttributeList=0x16f4a0, lpSize=0x16f568) returned 1 [0195.896] UpdateProcThreadAttribute (in: lpAttributeList=0x16f4a0, dwFlags=0x0, Attribute=0x60001, lpValue=0x16f560, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x16f4a0, lpPreviousValue=0x0) returned 1 [0195.896] GetStartupInfoW (in: lpStartupInfo=0x16f45c | out: lpStartupInfo=0x16f45c*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x80, hStdOutput=0x3f0, hStdError=0x3f8)) [0195.896] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x18) returned 0x5e36c8 [0195.896] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0195.896] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0195.896] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0195.896] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0195.896] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0195.896] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0195.896] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0195.897] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0195.897] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0195.897] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0195.897] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0195.897] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0195.897] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0195.897] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0195.897] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0195.897] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0195.897] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0195.897] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0195.897] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0195.897] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0195.897] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0195.897] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0195.897] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0195.897] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0195.897] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0195.897] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0195.897] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0195.897] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0195.897] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0195.897] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0195.897] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0195.897] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0195.897] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0195.897] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0195.897] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0195.897] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0195.897] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0195.897] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0195.897] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0195.897] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0195.897] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0195.897] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0195.897] GetProcessHeap () returned 0x5d0000 [0195.898] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e36c8 | out: hHeap=0x5d0000) returned 1 [0195.898] GetProcessHeap () returned 0x5d0000 [0195.898] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xa) returned 0x5dff98 [0195.898] lstrcmpW (lpString1="\\findstr.exe", lpString2="\\XCOPY.EXE") returned -1 [0195.898] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\findstr.exe", lpCommandLine="findstr All", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x16f4fc*(cb=0x48, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="findstr All", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x16f548 | out: lpCommandLine="findstr All", lpProcessInformation=0x16f548*(hProcess=0x8c, hThread=0x74, dwProcessId=0x320, dwThreadId=0x760)) returned 1 [0195.966] CloseHandle (hObject=0x74) returned 1 [0195.966] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0195.966] GetProcessHeap () returned 0x5d0000 [0195.966] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5ec440 | out: hHeap=0x5d0000) returned 1 [0195.966] GetEnvironmentStringsW () returned 0x5eb8c8* [0195.966] GetProcessHeap () returned 0x5d0000 [0195.966] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xb70) returned 0x5ec440 [0195.966] FreeEnvironmentStringsW (penv=0x5eb8c8) returned 1 [0195.966] GetProcessHeap () returned 0x5d0000 [0195.966] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5dff98 | out: hHeap=0x5d0000) returned 1 [0195.966] DeleteProcThreadAttributeList (in: lpAttributeList=0x16f4a0 | out: lpAttributeList=0x16f4a0) [0195.966] _dup2 (_FileHandleSrc=4, _FileHandleDst=0) returned 0 [0195.967] _close (_FileHandle=4) returned 0 [0195.967] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0xffffffff) returned 0x0 [0216.664] GetExitCodeProcess (in: hProcess=0x84, lpExitCode=0x16f890 | out: lpExitCode=0x16f890*=0x1) returned 1 [0216.664] CloseHandle (hObject=0x84) returned 1 [0216.664] WaitForSingleObject (hHandle=0x8c, dwMilliseconds=0xffffffff) returned 0x0 [0216.664] GetExitCodeProcess (in: hProcess=0x8c, lpExitCode=0x16f890 | out: lpExitCode=0x16f890*=0x1) returned 1 [0216.664] CloseHandle (hObject=0x8c) returned 1 [0216.664] _get_osfhandle (_FileHandle=1) returned 0x3f0 [0216.664] SetConsoleMode (hConsoleHandle=0x3f0, dwMode=0x0) returned 0 [0216.665] _get_osfhandle (_FileHandle=1) returned 0x3f0 [0216.665] GetConsoleMode (in: hConsoleHandle=0x3f0, lpMode=0x4a5c41ac | out: lpMode=0x4a5c41ac) returned 0 [0216.665] _get_osfhandle (_FileHandle=0) returned 0x80 [0216.665] GetConsoleMode (in: hConsoleHandle=0x80, lpMode=0x4a5c41b0 | out: lpMode=0x4a5c41b0) returned 0 [0216.665] GetConsoleOutputCP () returned 0x1b5 [0216.665] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a5c4260 | out: lpCPInfo=0x4a5c4260) returned 1 [0216.665] SetThreadUILanguage (LangId=0x0) returned 0x409 [0216.665] exit (_Code=1) Process: id = "16" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0xd149000" os_pid = "0x528" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "14" os_parent_pid = "0x460" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /C tasklist /FO TABLE > \"C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\processes.txt\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ef13" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 99 os_tid = 0x6e4 [0195.615] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x3bfd44 | out: lpSystemTimeAsFileTime=0x3bfd44*(dwLowDateTime=0x42e38f50, dwHighDateTime=0x1d69aeb)) [0195.615] GetCurrentProcessId () returned 0x528 [0195.615] GetCurrentThreadId () returned 0x6e4 [0195.615] GetTickCount () returned 0x1139647 [0195.615] QueryPerformanceCounter (in: lpPerformanceCount=0x3bfd3c | out: lpPerformanceCount=0x3bfd3c*=10487544229) returned 1 [0195.616] GetModuleHandleA (lpModuleName=0x0) returned 0x4a5a0000 [0195.616] __set_app_type (_Type=0x1) [0195.616] __p__fmode () returned 0x76a131f4 [0195.616] __p__commode () returned 0x76a131fc [0195.617] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a5c21a6) returned 0x0 [0195.617] __getmainargs (in: _Argc=0x4a5c4238, _Argv=0x4a5c4240, _Env=0x4a5c423c, _DoWildCard=0, _StartInfo=0x4a5c4140 | out: _Argc=0x4a5c4238, _Argv=0x4a5c4240, _Env=0x4a5c423c) returned 0 [0195.617] GetCurrentThreadId () returned 0x6e4 [0195.617] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x6e4) returned 0x60 [0195.617] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76a20000 [0195.617] GetProcAddress (hModule=0x76a20000, lpProcName="SetThreadUILanguage") returned 0x76a4a84f [0195.617] SetThreadUILanguage (LangId=0x0) returned 0x409 [0195.620] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0195.620] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x3bfcd4 | out: phkResult=0x3bfcd4*=0x0) returned 0x2 [0195.620] VirtualQuery (in: lpAddress=0x3bfd0b, lpBuffer=0x3bfca4, dwLength=0x1c | out: lpBuffer=0x3bfca4*(BaseAddress=0x3bf000, AllocationBase=0x2c0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0195.620] VirtualQuery (in: lpAddress=0x2c0000, lpBuffer=0x3bfca4, dwLength=0x1c | out: lpBuffer=0x3bfca4*(BaseAddress=0x2c0000, AllocationBase=0x2c0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0195.620] VirtualQuery (in: lpAddress=0x2c1000, lpBuffer=0x3bfca4, dwLength=0x1c | out: lpBuffer=0x3bfca4*(BaseAddress=0x2c1000, AllocationBase=0x2c0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0195.620] VirtualQuery (in: lpAddress=0x2c3000, lpBuffer=0x3bfca4, dwLength=0x1c | out: lpBuffer=0x3bfca4*(BaseAddress=0x2c3000, AllocationBase=0x2c0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0195.620] VirtualQuery (in: lpAddress=0x3c0000, lpBuffer=0x3bfca4, dwLength=0x1c | out: lpBuffer=0x3bfca4*(BaseAddress=0x3c0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x130000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0195.620] GetConsoleOutputCP () returned 0x1b5 [0195.620] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a5c4260 | out: lpCPInfo=0x4a5c4260) returned 1 [0195.620] SetConsoleCtrlHandler (HandlerRoutine=0x4a5be72a, Add=1) returned 1 [0195.621] _get_osfhandle (_FileHandle=1) returned 0x7 [0195.621] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0195.621] _get_osfhandle (_FileHandle=1) returned 0x7 [0195.621] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a5c41ac | out: lpMode=0x4a5c41ac) returned 1 [0195.621] _get_osfhandle (_FileHandle=1) returned 0x7 [0195.621] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0195.621] _get_osfhandle (_FileHandle=0) returned 0x3 [0195.621] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a5c41b0 | out: lpMode=0x4a5c41b0) returned 1 [0195.623] _get_osfhandle (_FileHandle=0) returned 0x3 [0195.623] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0195.623] GetEnvironmentStringsW () returned 0x6b2200* [0195.623] GetProcessHeap () returned 0x6a0000 [0195.623] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0xb02) returned 0x6b2d10 [0195.624] FreeEnvironmentStringsW (penv=0x6b2200) returned 1 [0195.624] GetProcessHeap () returned 0x6a0000 [0195.624] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x4) returned 0x6b18e0 [0195.624] GetEnvironmentStringsW () returned 0x6b2200* [0195.624] GetProcessHeap () returned 0x6a0000 [0195.624] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0xb02) returned 0x6b3820 [0195.624] FreeEnvironmentStringsW (penv=0x6b2200) returned 1 [0195.624] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x3bec44 | out: phkResult=0x3bec44*=0x68) returned 0x0 [0195.624] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x3bec4c, lpData=0x3bec50, lpcbData=0x3bec48*=0x1000 | out: lpType=0x3bec4c*=0x0, lpData=0x3bec50*=0x0, lpcbData=0x3bec48*=0x1000) returned 0x2 [0195.624] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x3bec4c, lpData=0x3bec50, lpcbData=0x3bec48*=0x1000 | out: lpType=0x3bec4c*=0x4, lpData=0x3bec50*=0x1, lpcbData=0x3bec48*=0x4) returned 0x0 [0195.624] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x3bec4c, lpData=0x3bec50, lpcbData=0x3bec48*=0x1000 | out: lpType=0x3bec4c*=0x0, lpData=0x3bec50*=0x1, lpcbData=0x3bec48*=0x1000) returned 0x2 [0195.624] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x3bec4c, lpData=0x3bec50, lpcbData=0x3bec48*=0x1000 | out: lpType=0x3bec4c*=0x4, lpData=0x3bec50*=0x0, lpcbData=0x3bec48*=0x4) returned 0x0 [0195.624] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x3bec4c, lpData=0x3bec50, lpcbData=0x3bec48*=0x1000 | out: lpType=0x3bec4c*=0x4, lpData=0x3bec50*=0x40, lpcbData=0x3bec48*=0x4) returned 0x0 [0195.624] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x3bec4c, lpData=0x3bec50, lpcbData=0x3bec48*=0x1000 | out: lpType=0x3bec4c*=0x4, lpData=0x3bec50*=0x40, lpcbData=0x3bec48*=0x4) returned 0x0 [0195.624] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x3bec4c, lpData=0x3bec50, lpcbData=0x3bec48*=0x1000 | out: lpType=0x3bec4c*=0x0, lpData=0x3bec50*=0x40, lpcbData=0x3bec48*=0x1000) returned 0x2 [0195.624] RegCloseKey (hKey=0x68) returned 0x0 [0195.625] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x3bec44 | out: phkResult=0x3bec44*=0x68) returned 0x0 [0195.625] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x3bec4c, lpData=0x3bec50, lpcbData=0x3bec48*=0x1000 | out: lpType=0x3bec4c*=0x0, lpData=0x3bec50*=0x40, lpcbData=0x3bec48*=0x1000) returned 0x2 [0195.625] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x3bec4c, lpData=0x3bec50, lpcbData=0x3bec48*=0x1000 | out: lpType=0x3bec4c*=0x4, lpData=0x3bec50*=0x1, lpcbData=0x3bec48*=0x4) returned 0x0 [0195.625] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x3bec4c, lpData=0x3bec50, lpcbData=0x3bec48*=0x1000 | out: lpType=0x3bec4c*=0x0, lpData=0x3bec50*=0x1, lpcbData=0x3bec48*=0x1000) returned 0x2 [0195.625] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x3bec4c, lpData=0x3bec50, lpcbData=0x3bec48*=0x1000 | out: lpType=0x3bec4c*=0x4, lpData=0x3bec50*=0x0, lpcbData=0x3bec48*=0x4) returned 0x0 [0195.625] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x3bec4c, lpData=0x3bec50, lpcbData=0x3bec48*=0x1000 | out: lpType=0x3bec4c*=0x4, lpData=0x3bec50*=0x9, lpcbData=0x3bec48*=0x4) returned 0x0 [0195.625] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x3bec4c, lpData=0x3bec50, lpcbData=0x3bec48*=0x1000 | out: lpType=0x3bec4c*=0x4, lpData=0x3bec50*=0x9, lpcbData=0x3bec48*=0x4) returned 0x0 [0195.625] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x3bec4c, lpData=0x3bec50, lpcbData=0x3bec48*=0x1000 | out: lpType=0x3bec4c*=0x0, lpData=0x3bec50*=0x9, lpcbData=0x3bec48*=0x1000) returned 0x2 [0195.625] RegCloseKey (hKey=0x68) returned 0x0 [0195.625] time (in: timer=0x0 | out: timer=0x0) returned 0x5f7aceb4 [0195.625] srand (_Seed=0x5f7aceb4) [0195.625] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /C tasklist /FO TABLE > \"C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\processes.txt\"" [0195.625] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /C tasklist /FO TABLE > \"C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\processes.txt\"" [0195.656] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a5c5260 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0195.662] GetProcessHeap () returned 0x6a0000 [0195.662] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x210) returned 0x6b2200 [0195.662] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6b2208, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0195.662] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a5d0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0195.662] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a5d0640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0195.662] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a5d0640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0195.662] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0195.662] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0195.662] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0195.662] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0195.662] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0195.662] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0195.662] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0195.662] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0195.662] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0195.662] GetProcessHeap () returned 0x6a0000 [0195.663] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b2d10 | out: hHeap=0x6a0000) returned 1 [0195.663] GetEnvironmentStringsW () returned 0x6b2418* [0195.663] GetProcessHeap () returned 0x6a0000 [0195.663] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0xb1a) returned 0x6b4e58 [0195.663] FreeEnvironmentStringsW (penv=0x6b2418) returned 1 [0195.663] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a5d0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0195.663] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a5d0640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0195.663] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0195.663] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0195.663] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0195.663] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0195.663] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0195.663] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0195.663] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0195.663] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0195.663] GetProcessHeap () returned 0x6a0000 [0195.663] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x30) returned 0x6b2080 [0195.663] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x3bfa10 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0195.663] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x104, lpBuffer=0x3bfa10, lpFilePart=0x3bfa0c | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x3bfa0c*="system32") returned 0x13 [0195.663] GetFileAttributesW (lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0195.664] FindFirstFileW (in: lpFileName="C:\\Windows", lpFindFileData=0x3bf78c | out: lpFindFileData=0x3bf78c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x6b5980 [0195.664] FindClose (in: hFindFile=0x6b5980 | out: hFindFile=0x6b5980) returned 1 [0195.665] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x3bf78c | out: lpFindFileData=0x3bf78c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xefd85d60, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xefd85d60, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System32", cAlternateFileName="")) returned 0x6a0ff0 [0195.665] FindClose (in: hFindFile=0x6a0ff0 | out: hFindFile=0x6a0ff0) returned 1 [0195.665] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0195.665] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0195.665] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0195.665] GetProcessHeap () returned 0x6a0000 [0195.665] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4e58 | out: hHeap=0x6a0000) returned 1 [0195.665] GetEnvironmentStringsW () returned 0x6b4330* [0195.665] GetProcessHeap () returned 0x6a0000 [0195.665] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0xb4a) returned 0x6b4e88 [0195.665] FreeEnvironmentStringsW (penv=0x6b4330) returned 1 [0195.665] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a5c5260 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0195.665] GetProcessHeap () returned 0x6a0000 [0195.665] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b2080 | out: hHeap=0x6a0000) returned 1 [0195.665] GetProcessHeap () returned 0x6a0000 [0195.665] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x400e) returned 0x6b59e0 [0195.666] GetProcessHeap () returned 0x6a0000 [0195.666] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x124) returned 0x6a0ff0 [0195.666] GetProcessHeap () returned 0x6a0000 [0195.666] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b59e0 | out: hHeap=0x6a0000) returned 1 [0195.666] GetConsoleOutputCP () returned 0x1b5 [0195.666] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a5c4260 | out: lpCPInfo=0x4a5c4260) returned 1 [0195.666] GetUserDefaultLCID () returned 0x409 [0195.666] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a5c4950, cchData=8 | out: lpLCData=":") returned 2 [0195.667] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x3bfb50, cchData=128 | out: lpLCData="0") returned 2 [0195.667] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x3bfb50, cchData=128 | out: lpLCData="0") returned 2 [0195.667] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x3bfb50, cchData=128 | out: lpLCData="1") returned 2 [0195.667] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a5c4940, cchData=8 | out: lpLCData="/") returned 2 [0195.667] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a5c4d80, cchData=32 | out: lpLCData="Mon") returned 4 [0195.667] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a5c4d40, cchData=32 | out: lpLCData="Tue") returned 4 [0195.667] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a5c4d00, cchData=32 | out: lpLCData="Wed") returned 4 [0195.667] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a5c4cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0195.667] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a5c4c80, cchData=32 | out: lpLCData="Fri") returned 4 [0195.667] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a5c4c40, cchData=32 | out: lpLCData="Sat") returned 4 [0195.667] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a5c4c00, cchData=32 | out: lpLCData="Sun") returned 4 [0195.667] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a5c4930, cchData=8 | out: lpLCData=".") returned 2 [0195.667] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a5c4920, cchData=8 | out: lpLCData=",") returned 2 [0195.667] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0195.668] GetProcessHeap () returned 0x6a0000 [0195.668] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20c) returned 0x6b2f70 [0195.668] GetConsoleTitleW (in: lpConsoleTitle=0x6b2f70, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0195.669] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76a20000 [0195.669] GetProcAddress (hModule=0x76a20000, lpProcName="CopyFileExW") returned 0x76a53b92 [0195.669] GetProcAddress (hModule=0x76a20000, lpProcName="IsDebuggerPresent") returned 0x76a34a5d [0195.669] GetProcAddress (hModule=0x76a20000, lpProcName="SetConsoleInputExeNameW") returned 0x76a4a79d [0195.669] GetProcessHeap () returned 0x6a0000 [0195.669] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x400a) returned 0x6b59e0 [0195.669] GetProcessHeap () returned 0x6a0000 [0195.669] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b59e0 | out: hHeap=0x6a0000) returned 1 [0195.670] _wcsicmp (_String1="tasklist", _String2=")") returned 75 [0195.670] _wcsicmp (_String1="FOR", _String2="tasklist") returned -14 [0195.670] _wcsicmp (_String1="FOR/?", _String2="tasklist") returned -14 [0195.670] _wcsicmp (_String1="IF", _String2="tasklist") returned -11 [0195.670] _wcsicmp (_String1="IF/?", _String2="tasklist") returned -11 [0195.670] _wcsicmp (_String1="REM", _String2="tasklist") returned -2 [0195.670] _wcsicmp (_String1="REM/?", _String2="tasklist") returned -2 [0195.670] GetProcessHeap () returned 0x6a0000 [0195.670] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x58) returned 0x6a1120 [0195.670] GetProcessHeap () returned 0x6a0000 [0195.670] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1a) returned 0x6a0830 [0195.670] GetProcessHeap () returned 0x6a0000 [0195.670] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x20) returned 0x6a0858 [0195.671] GetProcessHeap () returned 0x6a0000 [0195.671] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x20) returned 0x6a0880 [0195.675] GetProcessHeap () returned 0x6a0000 [0195.675] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0xf6) returned 0x6a1180 [0195.676] GetProcessHeap () returned 0x6a0000 [0195.676] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x18) returned 0x6a1280 [0195.676] _get_osfhandle (_FileHandle=1) returned 0x7 [0195.676] _get_osfhandle (_FileHandle=1) returned 0x7 [0195.676] _get_osfhandle (_FileHandle=1) returned 0x7 [0195.676] GetFileType (hFile=0x7) returned 0x2 [0195.677] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0195.677] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x3bfa48 | out: lpMode=0x3bfa48) returned 1 [0195.677] _dup (_FileHandle=1) returned 3 [0195.677] _close (_FileHandle=1) returned 0 [0195.678] _wcsicmp (_String1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\processes.txt", _String2="con") returned -53 [0195.678] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\processes.txt" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\9df274b54410817b3690312b4cb55431\\ec3947efc19179a8010c6bae37caac89\\processes.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x3bfa18, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0195.678] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 1 [0195.678] GetConsoleTitleW (in: lpConsoleTitle=0x3bf848, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0195.679] _wcsicmp (_String1="tasklist", _String2="DIR") returned 16 [0195.679] _wcsicmp (_String1="tasklist", _String2="ERASE") returned 15 [0195.679] _wcsicmp (_String1="tasklist", _String2="DEL") returned 16 [0195.679] _wcsicmp (_String1="tasklist", _String2="TYPE") returned -24 [0195.679] _wcsicmp (_String1="tasklist", _String2="COPY") returned 17 [0195.679] _wcsicmp (_String1="tasklist", _String2="CD") returned 17 [0195.679] _wcsicmp (_String1="tasklist", _String2="CHDIR") returned 17 [0195.679] _wcsicmp (_String1="tasklist", _String2="RENAME") returned 2 [0195.679] _wcsicmp (_String1="tasklist", _String2="REN") returned 2 [0195.679] _wcsicmp (_String1="tasklist", _String2="ECHO") returned 15 [0195.679] _wcsicmp (_String1="tasklist", _String2="SET") returned 1 [0195.679] _wcsicmp (_String1="tasklist", _String2="PAUSE") returned 4 [0195.679] _wcsicmp (_String1="tasklist", _String2="DATE") returned 16 [0195.679] _wcsicmp (_String1="tasklist", _String2="TIME") returned -8 [0195.679] _wcsicmp (_String1="tasklist", _String2="PROMPT") returned 4 [0195.679] _wcsicmp (_String1="tasklist", _String2="MD") returned 7 [0195.679] _wcsicmp (_String1="tasklist", _String2="MKDIR") returned 7 [0195.679] _wcsicmp (_String1="tasklist", _String2="RD") returned 2 [0195.679] _wcsicmp (_String1="tasklist", _String2="RMDIR") returned 2 [0195.679] _wcsicmp (_String1="tasklist", _String2="PATH") returned 4 [0195.679] _wcsicmp (_String1="tasklist", _String2="GOTO") returned 13 [0195.679] _wcsicmp (_String1="tasklist", _String2="SHIFT") returned 1 [0195.680] _wcsicmp (_String1="tasklist", _String2="CLS") returned 17 [0195.680] _wcsicmp (_String1="tasklist", _String2="CALL") returned 17 [0195.680] _wcsicmp (_String1="tasklist", _String2="VERIFY") returned -2 [0195.680] _wcsicmp (_String1="tasklist", _String2="VER") returned -2 [0195.680] _wcsicmp (_String1="tasklist", _String2="VOL") returned -2 [0195.680] _wcsicmp (_String1="tasklist", _String2="EXIT") returned 15 [0195.680] _wcsicmp (_String1="tasklist", _String2="SETLOCAL") returned 1 [0195.680] _wcsicmp (_String1="tasklist", _String2="ENDLOCAL") returned 15 [0195.680] _wcsicmp (_String1="tasklist", _String2="TITLE") returned -8 [0195.680] _wcsicmp (_String1="tasklist", _String2="START") returned 1 [0195.680] _wcsicmp (_String1="tasklist", _String2="DPATH") returned 16 [0195.680] _wcsicmp (_String1="tasklist", _String2="KEYS") returned 9 [0195.680] _wcsicmp (_String1="tasklist", _String2="MOVE") returned 7 [0195.680] _wcsicmp (_String1="tasklist", _String2="PUSHD") returned 4 [0195.680] _wcsicmp (_String1="tasklist", _String2="POPD") returned 4 [0195.680] _wcsicmp (_String1="tasklist", _String2="ASSOC") returned 19 [0195.680] _wcsicmp (_String1="tasklist", _String2="FTYPE") returned 14 [0195.680] _wcsicmp (_String1="tasklist", _String2="BREAK") returned 18 [0195.680] _wcsicmp (_String1="tasklist", _String2="COLOR") returned 17 [0195.680] _wcsicmp (_String1="tasklist", _String2="MKLINK") returned 7 [0195.680] _wcsicmp (_String1="tasklist", _String2="DIR") returned 16 [0195.680] _wcsicmp (_String1="tasklist", _String2="ERASE") returned 15 [0195.680] _wcsicmp (_String1="tasklist", _String2="DEL") returned 16 [0195.680] _wcsicmp (_String1="tasklist", _String2="TYPE") returned -24 [0195.680] _wcsicmp (_String1="tasklist", _String2="COPY") returned 17 [0195.680] _wcsicmp (_String1="tasklist", _String2="CD") returned 17 [0195.680] _wcsicmp (_String1="tasklist", _String2="CHDIR") returned 17 [0195.680] _wcsicmp (_String1="tasklist", _String2="RENAME") returned 2 [0195.680] _wcsicmp (_String1="tasklist", _String2="REN") returned 2 [0195.680] _wcsicmp (_String1="tasklist", _String2="ECHO") returned 15 [0195.681] _wcsicmp (_String1="tasklist", _String2="SET") returned 1 [0195.681] _wcsicmp (_String1="tasklist", _String2="PAUSE") returned 4 [0195.681] _wcsicmp (_String1="tasklist", _String2="DATE") returned 16 [0195.681] _wcsicmp (_String1="tasklist", _String2="TIME") returned -8 [0195.681] _wcsicmp (_String1="tasklist", _String2="PROMPT") returned 4 [0195.681] _wcsicmp (_String1="tasklist", _String2="MD") returned 7 [0195.681] _wcsicmp (_String1="tasklist", _String2="MKDIR") returned 7 [0195.681] _wcsicmp (_String1="tasklist", _String2="RD") returned 2 [0195.681] _wcsicmp (_String1="tasklist", _String2="RMDIR") returned 2 [0195.681] _wcsicmp (_String1="tasklist", _String2="PATH") returned 4 [0195.681] _wcsicmp (_String1="tasklist", _String2="GOTO") returned 13 [0195.681] _wcsicmp (_String1="tasklist", _String2="SHIFT") returned 1 [0195.681] _wcsicmp (_String1="tasklist", _String2="CLS") returned 17 [0195.681] _wcsicmp (_String1="tasklist", _String2="CALL") returned 17 [0195.681] _wcsicmp (_String1="tasklist", _String2="VERIFY") returned -2 [0195.681] _wcsicmp (_String1="tasklist", _String2="VER") returned -2 [0195.681] _wcsicmp (_String1="tasklist", _String2="VOL") returned -2 [0195.681] _wcsicmp (_String1="tasklist", _String2="EXIT") returned 15 [0195.681] _wcsicmp (_String1="tasklist", _String2="SETLOCAL") returned 1 [0195.681] _wcsicmp (_String1="tasklist", _String2="ENDLOCAL") returned 15 [0195.681] _wcsicmp (_String1="tasklist", _String2="TITLE") returned -8 [0195.681] _wcsicmp (_String1="tasklist", _String2="START") returned 1 [0195.681] _wcsicmp (_String1="tasklist", _String2="DPATH") returned 16 [0195.681] _wcsicmp (_String1="tasklist", _String2="KEYS") returned 9 [0195.681] _wcsicmp (_String1="tasklist", _String2="MOVE") returned 7 [0195.681] _wcsicmp (_String1="tasklist", _String2="PUSHD") returned 4 [0195.681] _wcsicmp (_String1="tasklist", _String2="POPD") returned 4 [0195.681] _wcsicmp (_String1="tasklist", _String2="ASSOC") returned 19 [0195.681] _wcsicmp (_String1="tasklist", _String2="FTYPE") returned 14 [0195.681] _wcsicmp (_String1="tasklist", _String2="BREAK") returned 18 [0195.681] _wcsicmp (_String1="tasklist", _String2="COLOR") returned 17 [0195.681] _wcsicmp (_String1="tasklist", _String2="MKLINK") returned 7 [0195.682] _wcsicmp (_String1="tasklist", _String2="FOR") returned 14 [0195.682] _wcsicmp (_String1="tasklist", _String2="IF") returned 11 [0195.682] _wcsicmp (_String1="tasklist", _String2="REM") returned 2 [0195.682] GetProcessHeap () returned 0x6a0000 [0195.682] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x210) returned 0x6b3188 [0195.682] GetProcessHeap () returned 0x6a0000 [0195.682] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x32) returned 0x6a12a0 [0195.682] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17 [0195.682] GetProcessHeap () returned 0x6a0000 [0195.682] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x418) returned 0x6b33a0 [0195.682] SetErrorMode (uMode=0x0) returned 0x0 [0195.682] SetErrorMode (uMode=0x1) returned 0x0 [0195.683] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x6b33a8, lpFilePart=0x3bf368 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x3bf368*="system32") returned 0x13 [0195.683] SetErrorMode (uMode=0x0) returned 0x1 [0195.683] GetProcessHeap () returned 0x6a0000 [0195.683] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b33a0, Size=0x42) returned 0x6b33a0 [0195.683] GetProcessHeap () returned 0x6a0000 [0195.683] RtlSizeHeap (HeapHandle=0x6a0000, Flags=0x0, MemoryPointer=0x6b33a0) returned 0x42 [0195.683] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a5d0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0195.683] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0195.683] GetProcessHeap () returned 0x6a0000 [0195.683] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0xfc) returned 0x6b33f0 [0195.683] GetProcessHeap () returned 0x6a0000 [0195.683] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1f0) returned 0x6b34f8 [0195.687] GetProcessHeap () returned 0x6a0000 [0195.687] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b34f8, Size=0xfe) returned 0x6b34f8 [0195.687] GetProcessHeap () returned 0x6a0000 [0195.687] RtlSizeHeap (HeapHandle=0x6a0000, Flags=0x0, MemoryPointer=0x6b34f8) returned 0xfe [0195.687] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a5d0640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0195.688] GetProcessHeap () returned 0x6a0000 [0195.688] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0xe0) returned 0x6b3600 [0195.688] GetProcessHeap () returned 0x6a0000 [0195.688] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b3600, Size=0x76) returned 0x6b3600 [0195.688] GetProcessHeap () returned 0x6a0000 [0195.688] RtlSizeHeap (HeapHandle=0x6a0000, Flags=0x0, MemoryPointer=0x6b3600) returned 0x76 [0195.688] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0195.688] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\tasklist.*", fInfoLevelId=0x1, lpFindFileData=0x3bf0e4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3bf0e4) returned 0x6b3680 [0195.688] GetProcessHeap () returned 0x6a0000 [0195.688] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6a12e0 [0195.688] FindClose (in: hFindFile=0x6b3680 | out: hFindFile=0x6b3680) returned 1 [0195.688] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\tasklist.COM", fInfoLevelId=0x1, lpFindFileData=0x3bf0e4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3bf0e4) returned 0xffffffff [0195.688] GetLastError () returned 0x2 [0195.688] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\tasklist.EXE", fInfoLevelId=0x1, lpFindFileData=0x3bf0e4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3bf0e4) returned 0x6b3680 [0195.688] GetProcessHeap () returned 0x6a0000 [0195.688] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6a12e0, Size=0x4) returned 0x6a12e0 [0195.688] FindClose (in: hFindFile=0x6b3680 | out: hFindFile=0x6b3680) returned 1 [0195.689] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0195.689] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0195.689] GetConsoleTitleW (in: lpConsoleTitle=0x3bf5dc, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0195.689] InitializeProcThreadAttributeList (in: lpAttributeList=0x3bf464, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x3bf52c | out: lpAttributeList=0x3bf464, lpSize=0x3bf52c) returned 1 [0195.689] UpdateProcThreadAttribute (in: lpAttributeList=0x3bf464, dwFlags=0x0, Attribute=0x60001, lpValue=0x3bf524, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x3bf464, lpPreviousValue=0x0) returned 1 [0195.689] GetStartupInfoW (in: lpStartupInfo=0x3bf420 | out: lpStartupInfo=0x3bf420*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0195.689] GetProcessHeap () returned 0x6a0000 [0195.689] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x18) returned 0x6b3680 [0195.689] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0195.689] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0195.689] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0195.689] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0195.689] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0195.689] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0195.689] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0195.689] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0195.689] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0195.689] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0195.689] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0195.689] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0195.689] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0195.689] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0195.689] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0195.689] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0195.689] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0195.690] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0195.690] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0195.690] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0195.690] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0195.690] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0195.690] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0195.690] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0195.690] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0195.690] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0195.690] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0195.690] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0195.690] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0195.690] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0195.690] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0195.690] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0195.690] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0195.690] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0195.690] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0195.690] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0195.690] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0195.690] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0195.690] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0195.690] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0195.690] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0195.690] GetProcessHeap () returned 0x6a0000 [0195.690] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b3680 | out: hHeap=0x6a0000) returned 1 [0195.690] GetProcessHeap () returned 0x6a0000 [0195.690] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0xa) returned 0x6b00d8 [0195.690] lstrcmpW (lpString1="\\tasklist.exe", lpString2="\\XCOPY.EXE") returned -1 [0195.691] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\tasklist.exe", lpCommandLine="tasklist /FO TABLE ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x3bf4c0*(cb=0x48, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="tasklist /FO TABLE ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x3bf50c | out: lpCommandLine="tasklist /FO TABLE ", lpProcessInformation=0x3bf50c*(hProcess=0x7c, hThread=0x78, dwProcessId=0x710, dwThreadId=0x6c4)) returned 1 [0195.705] CloseHandle (hObject=0x78) returned 1 [0195.705] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0195.705] GetProcessHeap () returned 0x6a0000 [0195.705] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4e88 | out: hHeap=0x6a0000) returned 1 [0195.705] GetEnvironmentStringsW () returned 0x6b44a0* [0195.706] GetProcessHeap () returned 0x6a0000 [0195.706] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0xb4a) returned 0x6b79e0 [0195.706] FreeEnvironmentStringsW (penv=0x6b44a0) returned 1 [0195.706] WaitForSingleObject (hHandle=0x7c, dwMilliseconds=0xffffffff) returned 0x0 [0205.267] GetExitCodeProcess (in: hProcess=0x7c, lpExitCode=0x3bf400 | out: lpExitCode=0x3bf400*=0x0) returned 1 [0205.267] CloseHandle (hObject=0x7c) returned 1 [0205.267] _vsnwprintf (in: _Buffer=0x3bf548, _BufferCount=0x13, _Format="%08X", _ArgList=0x3bf40c | out: _Buffer="00000000") returned 8 [0205.268] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0205.268] GetProcessHeap () returned 0x6a0000 [0205.268] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b79e0 | out: hHeap=0x6a0000) returned 1 [0205.268] GetEnvironmentStringsW () returned 0x6b79e0* [0205.268] GetProcessHeap () returned 0x6a0000 [0205.268] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0xb70) returned 0x6b8558 [0205.268] FreeEnvironmentStringsW (penv=0x6b79e0) returned 1 [0205.268] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0205.268] GetProcessHeap () returned 0x6a0000 [0205.268] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b8558 | out: hHeap=0x6a0000) returned 1 [0205.268] GetEnvironmentStringsW () returned 0x6b79e0* [0205.268] GetProcessHeap () returned 0x6a0000 [0205.268] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0xb70) returned 0x6b8558 [0205.268] FreeEnvironmentStringsW (penv=0x6b79e0) returned 1 [0205.268] GetProcessHeap () returned 0x6a0000 [0205.268] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b00d8 | out: hHeap=0x6a0000) returned 1 [0205.268] DeleteProcThreadAttributeList (in: lpAttributeList=0x3bf464 | out: lpAttributeList=0x3bf464) [0205.268] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0205.270] _close (_FileHandle=3) returned 0 [0205.270] _get_osfhandle (_FileHandle=1) returned 0x7 [0205.270] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0205.270] _get_osfhandle (_FileHandle=1) returned 0x7 [0205.270] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a5c41ac | out: lpMode=0x4a5c41ac) returned 1 [0205.271] _get_osfhandle (_FileHandle=0) returned 0x3 [0205.271] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a5c41b0 | out: lpMode=0x4a5c41b0) returned 1 [0205.271] SetConsoleInputExeNameW () returned 0x1 [0205.271] GetConsoleOutputCP () returned 0x1b5 [0205.271] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a5c4260 | out: lpCPInfo=0x4a5c4260) returned 1 [0205.271] SetThreadUILanguage (LangId=0x0) returned 0x409 [0205.271] exit (_Code=0) Process: id = "17" image_name = "tasklist.exe" filename = "c:\\windows\\syswow64\\tasklist.exe" page_root = "0x64214000" os_pid = "0x710" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "16" os_parent_pid = "0x528" cmd_line = "tasklist /FO TABLE " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ef13" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 100 os_tid = 0x6c4 Thread: id = 107 os_tid = 0x334 Thread: id = 110 os_tid = 0x570 Thread: id = 112 os_tid = 0x7d4 Thread: id = 113 os_tid = 0x7cc Process: id = "18" image_name = "chcp.com" filename = "c:\\windows\\syswow64\\chcp.com" page_root = "0xbdc2000" os_pid = "0x6c0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "15" os_parent_pid = "0x654" cmd_line = "chcp 65001 " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ef13" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 101 os_tid = 0x328 Process: id = "19" image_name = "netsh.exe" filename = "c:\\windows\\syswow64\\netsh.exe" page_root = "0xbaca000" os_pid = "0x330" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "15" os_parent_pid = "0x654" cmd_line = "netsh wlan show profile " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ef13" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 102 os_tid = 0x324 [0196.051] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x22f9c4 | out: lpSystemTimeAsFileTime=0x22f9c4*(dwLowDateTime=0x432635d0, dwHighDateTime=0x1d69aeb)) [0196.051] GetCurrentProcessId () returned 0x330 [0196.051] GetCurrentThreadId () returned 0x324 [0196.051] GetTickCount () returned 0x11397fc [0196.051] QueryPerformanceCounter (in: lpPerformanceCount=0x22f9bc | out: lpPerformanceCount=0x22f9bc*=10531186947) returned 1 [0196.053] GetModuleHandleA (lpModuleName=0x0) returned 0x17e0000 [0196.053] __set_app_type (_Type=0x1) [0196.053] __p__fmode () returned 0x76a131f4 [0196.053] __p__commode () returned 0x76a131fc [0196.053] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x17e93ef) returned 0x0 [0196.054] __wgetmainargs (in: _Argc=0x17f7ef0, _Argv=0x17f7ef8, _Env=0x17f7ef4, _DoWildCard=0, _StartInfo=0x17f7f00 | out: _Argc=0x17f7ef0, _Argv=0x17f7ef8, _Env=0x17f7ef4) returned 0 [0196.054] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0196.055] GetModuleHandleW (lpModuleName=0x0) returned 0x17e0000 [0196.055] _vsnwprintf (in: _Buffer=0x17f3ec0, _BufferCount=0x1fff, _Format="%s>", _ArgList=0x227530 | out: _Buffer="netsh>") returned 6 [0196.055] GetProcessHeap () returned 0x650000 [0196.055] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666130 [0196.056] GetProcessHeap () returned 0x650000 [0196.056] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666140 [0196.056] GetProcessHeap () returned 0x650000 [0196.056] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666150 [0196.056] GetProcessHeap () returned 0x650000 [0196.056] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666160 [0196.056] GetProcessHeap () returned 0x650000 [0196.056] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666170 [0196.056] GetProcessHeap () returned 0x650000 [0196.056] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666180 [0196.056] GetProcessHeap () returned 0x650000 [0196.056] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666190 [0196.056] GetProcessHeap () returned 0x650000 [0196.056] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6661a0 [0196.056] GetProcessHeap () returned 0x650000 [0196.056] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6661b0 [0196.056] GetProcessHeap () returned 0x650000 [0196.056] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6661c0 [0196.056] GetProcessHeap () returned 0x650000 [0196.056] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6661d0 [0196.056] GetProcessHeap () returned 0x650000 [0196.056] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6661e0 [0196.056] GetProcessHeap () returned 0x650000 [0196.056] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666208 [0196.056] GetProcessHeap () returned 0x650000 [0196.056] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666218 [0196.056] GetProcessHeap () returned 0x650000 [0196.056] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666228 [0196.056] GetProcessHeap () returned 0x650000 [0196.056] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666238 [0196.056] GetProcessHeap () returned 0x650000 [0196.056] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666248 [0196.056] GetProcessHeap () returned 0x650000 [0196.057] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666258 [0196.057] GetProcessHeap () returned 0x650000 [0196.057] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666268 [0196.057] GetProcessHeap () returned 0x650000 [0196.057] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666278 [0196.057] GetProcessHeap () returned 0x650000 [0196.057] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666288 [0196.057] GetProcessHeap () returned 0x650000 [0196.057] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666298 [0196.057] GetProcessHeap () returned 0x650000 [0196.057] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6662a8 [0196.057] GetProcessHeap () returned 0x650000 [0196.057] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6662b8 [0196.057] GetProcessHeap () returned 0x650000 [0196.057] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6662c8 [0196.057] GetProcessHeap () returned 0x650000 [0196.057] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6662d8 [0196.057] GetProcessHeap () returned 0x650000 [0196.057] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6662e8 [0196.057] GetProcessHeap () returned 0x650000 [0196.057] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6662f8 [0196.057] GetProcessHeap () returned 0x650000 [0196.057] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666308 [0196.057] GetProcessHeap () returned 0x650000 [0196.057] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666318 [0196.057] GetProcessHeap () returned 0x650000 [0196.057] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666328 [0196.057] GetProcessHeap () returned 0x650000 [0196.057] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666338 [0196.057] GetProcessHeap () returned 0x650000 [0196.057] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666348 [0196.057] GetProcessHeap () returned 0x650000 [0196.057] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666358 [0196.057] GetProcessHeap () returned 0x650000 [0196.057] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666368 [0196.057] GetProcessHeap () returned 0x650000 [0196.057] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666378 [0196.058] GetProcessHeap () returned 0x650000 [0196.058] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666388 [0196.058] GetProcessHeap () returned 0x650000 [0196.058] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666398 [0196.058] GetProcessHeap () returned 0x650000 [0196.058] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6663a8 [0196.058] GetProcessHeap () returned 0x650000 [0196.058] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6663b8 [0196.058] GetProcessHeap () returned 0x650000 [0196.058] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6663c8 [0196.058] GetProcessHeap () returned 0x650000 [0196.058] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6663d8 [0196.058] GetProcessHeap () returned 0x650000 [0196.058] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6663e8 [0196.058] GetProcessHeap () returned 0x650000 [0196.058] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6663f8 [0196.058] GetProcessHeap () returned 0x650000 [0196.058] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666408 [0196.058] GetProcessHeap () returned 0x650000 [0196.058] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666418 [0196.058] GetProcessHeap () returned 0x650000 [0196.058] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666428 [0196.058] GetProcessHeap () returned 0x650000 [0196.058] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666438 [0196.058] GetProcessHeap () returned 0x650000 [0196.058] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666448 [0196.058] GetProcessHeap () returned 0x650000 [0196.058] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666458 [0196.058] GetProcessHeap () returned 0x650000 [0196.058] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666468 [0196.058] GetProcessHeap () returned 0x650000 [0196.058] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666478 [0196.058] GetProcessHeap () returned 0x650000 [0196.058] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666488 [0196.058] GetProcessHeap () returned 0x650000 [0196.058] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666498 [0196.058] GetProcessHeap () returned 0x650000 [0196.058] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6664a8 [0196.058] GetProcessHeap () returned 0x650000 [0196.058] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6664b8 [0196.058] GetProcessHeap () returned 0x650000 [0196.058] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6664c8 [0196.059] GetProcessHeap () returned 0x650000 [0196.059] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6664d8 [0196.059] GetProcessHeap () returned 0x650000 [0196.059] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6664e8 [0196.059] GetProcessHeap () returned 0x650000 [0196.059] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6664f8 [0196.059] GetProcessHeap () returned 0x650000 [0196.059] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666508 [0196.059] GetProcessHeap () returned 0x650000 [0196.059] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666518 [0196.059] GetProcessHeap () returned 0x650000 [0196.059] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666528 [0196.059] GetProcessHeap () returned 0x650000 [0196.059] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666538 [0196.059] GetProcessHeap () returned 0x650000 [0196.059] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666548 [0196.059] GetProcessHeap () returned 0x650000 [0196.059] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666558 [0196.059] GetProcessHeap () returned 0x650000 [0196.059] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666568 [0196.059] GetProcessHeap () returned 0x650000 [0196.059] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666578 [0196.059] GetProcessHeap () returned 0x650000 [0196.059] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666588 [0196.059] GetProcessHeap () returned 0x650000 [0196.059] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666598 [0196.059] GetProcessHeap () returned 0x650000 [0196.059] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6665a8 [0196.059] GetProcessHeap () returned 0x650000 [0196.059] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6665b8 [0196.059] GetProcessHeap () returned 0x650000 [0196.059] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6665c8 [0196.059] GetProcessHeap () returned 0x650000 [0196.059] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6665d8 [0196.059] GetProcessHeap () returned 0x650000 [0196.060] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666608 [0196.060] GetProcessHeap () returned 0x650000 [0196.060] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666618 [0196.060] GetProcessHeap () returned 0x650000 [0196.060] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666628 [0196.060] GetProcessHeap () returned 0x650000 [0196.060] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666638 [0196.060] GetProcessHeap () returned 0x650000 [0196.060] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666648 [0196.060] GetProcessHeap () returned 0x650000 [0196.060] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666658 [0196.060] GetProcessHeap () returned 0x650000 [0196.060] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666668 [0196.060] GetProcessHeap () returned 0x650000 [0196.060] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666678 [0196.060] GetProcessHeap () returned 0x650000 [0196.060] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666688 [0196.060] GetProcessHeap () returned 0x650000 [0196.060] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666698 [0196.060] GetProcessHeap () returned 0x650000 [0196.060] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6666a8 [0196.060] GetProcessHeap () returned 0x650000 [0196.060] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6666b8 [0196.060] GetProcessHeap () returned 0x650000 [0196.060] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6666c8 [0196.060] GetProcessHeap () returned 0x650000 [0196.060] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6666d8 [0196.060] GetProcessHeap () returned 0x650000 [0196.060] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6666e8 [0196.060] GetProcessHeap () returned 0x650000 [0196.060] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6666f8 [0196.060] GetProcessHeap () returned 0x650000 [0196.060] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666708 [0196.060] GetProcessHeap () returned 0x650000 [0196.060] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666718 [0196.060] GetProcessHeap () returned 0x650000 [0196.060] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666728 [0196.060] GetProcessHeap () returned 0x650000 [0196.060] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666738 [0196.060] GetProcessHeap () returned 0x650000 [0196.060] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666748 [0196.060] GetProcessHeap () returned 0x650000 [0196.061] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666758 [0196.061] GetProcessHeap () returned 0x650000 [0196.061] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666768 [0196.061] GetProcessHeap () returned 0x650000 [0196.061] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666778 [0196.061] GetProcessHeap () returned 0x650000 [0196.061] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666788 [0196.061] GetProcessHeap () returned 0x650000 [0196.061] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666798 [0196.061] GetProcessHeap () returned 0x650000 [0196.061] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6667a8 [0196.061] GetProcessHeap () returned 0x650000 [0196.061] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6667b8 [0196.061] GetProcessHeap () returned 0x650000 [0196.061] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6667c8 [0196.061] GetProcessHeap () returned 0x650000 [0196.061] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6667d8 [0196.061] GetProcessHeap () returned 0x650000 [0196.061] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6667e8 [0196.061] GetProcessHeap () returned 0x650000 [0196.061] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6667f8 [0196.061] GetProcessHeap () returned 0x650000 [0196.061] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666808 [0196.061] GetProcessHeap () returned 0x650000 [0196.061] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666818 [0196.061] GetProcessHeap () returned 0x650000 [0196.061] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666828 [0196.061] GetProcessHeap () returned 0x650000 [0196.061] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666838 [0196.061] GetProcessHeap () returned 0x650000 [0196.061] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666848 [0196.061] GetProcessHeap () returned 0x650000 [0196.061] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666858 [0196.061] GetProcessHeap () returned 0x650000 [0196.061] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666868 [0196.061] GetProcessHeap () returned 0x650000 [0196.061] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666878 [0196.061] GetProcessHeap () returned 0x650000 [0196.061] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666888 [0196.061] GetProcessHeap () returned 0x650000 [0196.061] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666898 [0196.062] GetProcessHeap () returned 0x650000 [0196.062] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6668a8 [0196.062] GetProcessHeap () returned 0x650000 [0196.062] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6668b8 [0196.062] GetProcessHeap () returned 0x650000 [0196.062] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6668c8 [0196.062] GetProcessHeap () returned 0x650000 [0196.062] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6668d8 [0196.062] GetProcessHeap () returned 0x650000 [0196.062] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6668e8 [0196.062] GetProcessHeap () returned 0x650000 [0196.062] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6668f8 [0196.062] GetProcessHeap () returned 0x650000 [0196.062] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666908 [0196.062] GetProcessHeap () returned 0x650000 [0196.062] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666918 [0196.062] GetProcessHeap () returned 0x650000 [0196.062] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666928 [0196.062] GetProcessHeap () returned 0x650000 [0196.062] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666938 [0196.062] GetProcessHeap () returned 0x650000 [0196.062] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666948 [0196.062] GetProcessHeap () returned 0x650000 [0196.062] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666958 [0196.062] GetProcessHeap () returned 0x650000 [0196.062] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666968 [0196.062] GetProcessHeap () returned 0x650000 [0196.062] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666978 [0196.062] GetProcessHeap () returned 0x650000 [0196.062] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666988 [0196.062] GetProcessHeap () returned 0x650000 [0196.062] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666998 [0196.062] GetProcessHeap () returned 0x650000 [0196.062] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6669a8 [0196.062] GetProcessHeap () returned 0x650000 [0196.062] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6669b8 [0196.062] GetProcessHeap () returned 0x650000 [0196.062] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6669c8 [0196.062] GetProcessHeap () returned 0x650000 [0196.062] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x6669d8 [0196.062] GetProcessHeap () returned 0x650000 [0196.062] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666a08 [0196.063] GetProcessHeap () returned 0x650000 [0196.063] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666a18 [0196.063] GetProcessHeap () returned 0x650000 [0196.063] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666a28 [0196.063] GetProcessHeap () returned 0x650000 [0196.063] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666a38 [0196.063] GetProcessHeap () returned 0x650000 [0196.063] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666a48 [0196.063] GetProcessHeap () returned 0x650000 [0196.063] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666a58 [0196.063] GetProcessHeap () returned 0x650000 [0196.063] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666a68 [0196.063] GetProcessHeap () returned 0x650000 [0196.063] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666a78 [0196.063] GetProcessHeap () returned 0x650000 [0196.063] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666a88 [0196.063] GetProcessHeap () returned 0x650000 [0196.063] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666a98 [0196.063] GetProcessHeap () returned 0x650000 [0196.063] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666aa8 [0196.063] GetProcessHeap () returned 0x650000 [0196.063] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666ab8 [0196.063] GetProcessHeap () returned 0x650000 [0196.063] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666ac8 [0196.063] GetProcessHeap () returned 0x650000 [0196.063] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666ad8 [0196.063] GetProcessHeap () returned 0x650000 [0196.063] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666ae8 [0196.063] GetProcessHeap () returned 0x650000 [0196.063] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666af8 [0196.063] GetProcessHeap () returned 0x650000 [0196.063] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666b08 [0196.063] GetProcessHeap () returned 0x650000 [0196.063] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666b18 [0196.063] GetProcessHeap () returned 0x650000 [0196.063] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666b28 [0196.063] GetProcessHeap () returned 0x650000 [0196.063] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666b38 [0196.063] GetProcessHeap () returned 0x650000 [0196.063] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666b48 [0196.063] GetProcessHeap () returned 0x650000 [0196.063] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666b58 [0196.064] GetProcessHeap () returned 0x650000 [0196.064] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666b68 [0196.064] GetProcessHeap () returned 0x650000 [0196.064] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666b78 [0196.064] GetProcessHeap () returned 0x650000 [0196.064] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666b88 [0196.064] GetProcessHeap () returned 0x650000 [0196.064] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666b98 [0196.064] GetProcessHeap () returned 0x650000 [0196.064] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666ba8 [0196.064] GetProcessHeap () returned 0x650000 [0196.064] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666bb8 [0196.064] GetProcessHeap () returned 0x650000 [0196.064] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666bc8 [0196.064] GetProcessHeap () returned 0x650000 [0196.064] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666bd8 [0196.064] GetProcessHeap () returned 0x650000 [0196.064] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666be8 [0196.064] GetProcessHeap () returned 0x650000 [0196.064] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666bf8 [0196.064] GetProcessHeap () returned 0x650000 [0196.064] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666c08 [0196.064] GetProcessHeap () returned 0x650000 [0196.064] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666c18 [0196.064] GetProcessHeap () returned 0x650000 [0196.064] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666c28 [0196.064] GetProcessHeap () returned 0x650000 [0196.064] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666c38 [0196.064] GetProcessHeap () returned 0x650000 [0196.064] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666c48 [0196.064] GetProcessHeap () returned 0x650000 [0196.064] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666c58 [0196.064] GetProcessHeap () returned 0x650000 [0196.064] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666c68 [0196.064] GetProcessHeap () returned 0x650000 [0196.064] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666c78 [0196.064] GetProcessHeap () returned 0x650000 [0196.064] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666c88 [0196.064] GetProcessHeap () returned 0x650000 [0196.064] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666c98 [0196.064] GetProcessHeap () returned 0x650000 [0196.064] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666ca8 [0196.065] GetProcessHeap () returned 0x650000 [0196.065] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666cb8 [0196.065] GetProcessHeap () returned 0x650000 [0196.065] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666cc8 [0196.065] GetProcessHeap () returned 0x650000 [0196.065] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666cd8 [0196.065] GetProcessHeap () returned 0x650000 [0196.065] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666ce8 [0196.065] GetProcessHeap () returned 0x650000 [0196.065] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666cf8 [0196.065] GetProcessHeap () returned 0x650000 [0196.065] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666d08 [0196.065] GetProcessHeap () returned 0x650000 [0196.065] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666d18 [0196.065] GetProcessHeap () returned 0x650000 [0196.065] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666d28 [0196.065] GetProcessHeap () returned 0x650000 [0196.065] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666d38 [0196.065] GetProcessHeap () returned 0x650000 [0196.065] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666d48 [0196.065] GetProcessHeap () returned 0x650000 [0196.065] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666d58 [0196.065] GetProcessHeap () returned 0x650000 [0196.065] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666d68 [0196.065] GetProcessHeap () returned 0x650000 [0196.065] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666d78 [0196.065] GetProcessHeap () returned 0x650000 [0196.065] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666d88 [0196.065] GetProcessHeap () returned 0x650000 [0196.065] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666d98 [0196.065] GetProcessHeap () returned 0x650000 [0196.065] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666da8 [0196.065] GetProcessHeap () returned 0x650000 [0196.065] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666db8 [0196.065] GetProcessHeap () returned 0x650000 [0196.065] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666dc8 [0196.065] GetProcessHeap () returned 0x650000 [0196.065] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666dd8 [0196.065] GetProcessHeap () returned 0x650000 [0196.065] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666e08 [0196.066] GetProcessHeap () returned 0x650000 [0196.066] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666e18 [0196.066] GetProcessHeap () returned 0x650000 [0196.066] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666e28 [0196.066] GetProcessHeap () returned 0x650000 [0196.066] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666e38 [0196.066] GetProcessHeap () returned 0x650000 [0196.066] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666e48 [0196.066] GetProcessHeap () returned 0x650000 [0196.066] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666e58 [0196.066] GetProcessHeap () returned 0x650000 [0196.066] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666e68 [0196.066] GetProcessHeap () returned 0x650000 [0196.066] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666e78 [0196.066] GetProcessHeap () returned 0x650000 [0196.066] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666e88 [0196.066] GetProcessHeap () returned 0x650000 [0196.066] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666e98 [0196.066] GetProcessHeap () returned 0x650000 [0196.066] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666ea8 [0196.066] GetProcessHeap () returned 0x650000 [0196.066] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666eb8 [0196.066] GetProcessHeap () returned 0x650000 [0196.066] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x666ec8 [0196.066] _wcsicmp (_String1="netsh.exe", _String2="ipxmontr.dll") returned 5 [0196.066] _wcsicmp (_String1="netsh.exe", _String2="ipxpromn.dll") returned 5 [0196.066] GetProcessHeap () returned 0x650000 [0196.066] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x14) returned 0x6671f0 [0196.066] GetProcessHeap () returned 0x650000 [0196.066] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x2) returned 0x666ed8 [0196.066] GetProcessHeap () returned 0x650000 [0196.066] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x14) returned 0x667210 [0196.066] _wcsupr (in: _String="netsh.exe" | out: _String="NETSH.EXE") returned="NETSH.EXE" [0196.066] GetProcessHeap () returned 0x650000 [0196.067] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x650000) returned 1 [0196.067] GetProcessHeap () returned 0x650000 [0196.067] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x48) returned 0x667230 [0196.067] GetProcessHeap () returned 0x650000 [0196.067] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x650000) returned 1 [0196.067] GetProcessHeap () returned 0x650000 [0196.067] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x90) returned 0x667280 [0196.067] GetProcessHeap () returned 0x650000 [0196.067] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x667230 | out: hHeap=0x650000) returned 1 [0196.067] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\NetSh", ulOptions=0x0, samDesired=0x20019, phkResult=0x227524 | out: phkResult=0x227524*=0xb0) returned 0x0 [0196.067] RegQueryInfoKeyW (in: hKey=0xb0, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x22751c, lpcbMaxValueNameLen=0x227510, lpcbMaxValueLen=0x227514, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x22751c*=0x12, lpcbMaxValueNameLen=0x227510, lpcbMaxValueLen=0x227514, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0196.067] GetProcessHeap () returned 0x650000 [0196.067] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x16) returned 0x667230 [0196.067] GetProcessHeap () returned 0x650000 [0196.067] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x23) returned 0x667250 [0196.067] RegEnumValueW (in: hKey=0xb0, dwIndex=0x0, lpValueName=0x667230, lpcchValueName=0x227508, lpReserved=0x0, lpType=0x0, lpData=0x667250, lpcbData=0x22750c | out: lpValueName="4", lpcchValueName=0x227508, lpType=0x0, lpData=0x667250, lpcbData=0x22750c) returned 0x0 [0196.067] _wcsicmp (_String1="rasmontr.dll", _String2="ipxmontr.dll") returned 9 [0196.067] _wcsicmp (_String1="rasmontr.dll", _String2="ipxpromn.dll") returned 9 [0196.067] GetProcessHeap () returned 0x650000 [0196.067] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x28) returned 0x667318 [0196.067] GetProcessHeap () returned 0x650000 [0196.067] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x4) returned 0x666ee8 [0196.067] GetProcessHeap () returned 0x650000 [0196.067] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x1a) returned 0x6641f8 [0196.067] _wcsupr (in: _String="rasmontr.dll" | out: _String="RASMONTR.DLL") returned="RASMONTR.DLL" [0196.067] GetProcessHeap () returned 0x650000 [0196.067] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6671f0 | out: hHeap=0x650000) returned 1 [0196.068] LoadLibraryW (lpLibFileName="RASMONTR.DLL") returned 0x6f2c0000 [0199.028] LoadLibraryA (lpLibFileName="MSVCRT.DLL") returned 0x76970000 [0199.029] GetVersion () returned 0x1db10106 [0199.029] SetErrorMode (uMode=0x0) returned 0x0 [0199.029] SetErrorMode (uMode=0x8001) returned 0x0 [0199.055] LocalAlloc (uFlags=0x0, uBytes=0x2000) returned 0x6693e8 [0199.055] GetVersion () returned 0x1db10106 [0199.056] GlobalLock (hMem=0x2a0004) returned 0x667698 [0199.056] LocalAlloc (uFlags=0x40, uBytes=0x178) returned 0x6693e8 [0199.056] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x668ba8 [0199.056] LocalAlloc (uFlags=0x0, uBytes=0x8) returned 0x666ef8 [0199.056] malloc (_Size=0x80) returned 0x372520 [0199.056] __dllonexit () returned 0x6f0d47bb [0199.056] __dllonexit () returned 0x6f0d47ca [0199.056] __dllonexit () returned 0x6f0d47d9 [0199.057] __dllonexit () returned 0x6f0d47e8 [0199.057] __dllonexit () returned 0x6f0d49d1 [0199.057] __dllonexit () returned 0x6f0d4666 [0199.057] __dllonexit () returned 0x6f0d4a8d [0199.057] __dllonexit () returned 0x6f0d46cb [0199.057] __dllonexit () returned 0x6f0d4707 [0199.057] __dllonexit () returned 0x6f0d4716 [0199.057] __dllonexit () returned 0x6f0d4725 [0199.057] __dllonexit () returned 0x6f0d4b36 [0199.057] __dllonexit () returned 0x6f0d46da [0199.058] __dllonexit () returned 0x6f0d4833 [0199.058] __dllonexit () returned 0x6f0d46e9 [0199.058] __dllonexit () returned 0x6f0d4734 [0199.058] __dllonexit () returned 0x6f0d4743 [0199.058] __dllonexit () returned 0x6f0d4752 [0199.058] __dllonexit () returned 0x6f0d4761 [0199.058] __dllonexit () returned 0x6f0d4770 [0199.058] __dllonexit () returned 0x6f0d477f [0199.058] __dllonexit () returned 0x6f0d478e [0199.058] __dllonexit () returned 0x6f0d479d [0199.059] __dllonexit () returned 0x6f0d4cae [0199.059] __dllonexit () returned 0x6f0d48e2 [0199.059] __dllonexit () returned 0x6f0d4999 [0199.059] __dllonexit () returned 0x6f0d49b5 [0199.061] RegisterClipboardFormatW (lpszFormat="commctrl_DragListMsg") returned 0xc102 [0199.061] __dllonexit () returned 0x6f0d47f7 [0199.061] __dllonexit () returned 0x6f0d4806 [0199.061] __dllonexit () returned 0x6f0d4815 [0199.061] __dllonexit () returned 0x6f0d4824 [0199.062] GetVersion () returned 0x1db10106 [0199.062] GetVersion () returned 0x1db10106 [0199.062] GetVersion () returned 0x1db10106 [0199.062] __dllonexit () returned 0x6f0d4d35 [0199.062] __dllonexit () returned 0x6f0d45d2 [0199.062] __dllonexit () returned 0x6f0d46f8 [0199.062] __dllonexit () returned 0x6f0d4ae3 [0199.062] __dllonexit () returned 0x6f0d4aff [0199.062] __dllonexit () returned 0x6f0d45ec [0199.062] GetVersion () returned 0x1db10106 [0199.062] GetProcessVersion (ProcessId=0x0) returned 0x60001 [0199.062] GetSystemMetrics (nIndex=11) returned 32 [0199.062] GetSystemMetrics (nIndex=12) returned 32 [0199.063] GetSystemMetrics (nIndex=2) returned 17 [0199.063] GetSystemMetrics (nIndex=3) returned 17 [0199.063] GetDC (hWnd=0x0) returned 0xa010266 [0199.063] GetDeviceCaps (hdc=0xa010266, index=88) returned 96 [0199.063] GetDeviceCaps (hdc=0xa010266, index=90) returned 96 [0199.063] ReleaseDC (hWnd=0x0, hDC=0xa010266) returned 1 [0199.063] GetSysColor (nIndex=15) returned 0xf0f0f0 [0199.063] GetSysColor (nIndex=16) returned 0xa0a0a0 [0199.063] GetSysColor (nIndex=20) returned 0xffffff [0199.063] GetSysColor (nIndex=18) returned 0x0 [0199.063] GetSysColor (nIndex=6) returned 0x646464 [0199.063] GetSysColorBrush (nIndex=15) returned 0x1100059 [0199.063] GetSysColorBrush (nIndex=6) returned 0x1100061 [0199.063] LoadCursorW (hInstance=0x0, lpCursorName=0x7f02) returned 0x10007 [0199.063] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0199.063] __dllonexit () returned 0x6f0d4b1b [0199.063] RegisterClipboardFormatW (lpszFormat="commdlg_FindReplace") returned 0xc103 [0199.064] __dllonexit () returned 0x6f0d45fc [0199.064] RegisterClipboardFormatW (lpszFormat="Native") returned 0xc004 [0199.064] RegisterClipboardFormatW (lpszFormat="OwnerLink") returned 0xc003 [0199.064] RegisterClipboardFormatW (lpszFormat="ObjectLink") returned 0xc002 [0199.064] RegisterClipboardFormatW (lpszFormat="Embedded Object") returned 0xc00a [0199.064] RegisterClipboardFormatW (lpszFormat="Embed Source") returned 0xc00b [0199.064] RegisterClipboardFormatW (lpszFormat="Link Source") returned 0xc00d [0199.064] RegisterClipboardFormatW (lpszFormat="Object Descriptor") returned 0xc00e [0199.064] RegisterClipboardFormatW (lpszFormat="Link Source Descriptor") returned 0xc00f [0199.064] RegisterClipboardFormatW (lpszFormat="FileName") returned 0xc006 [0199.064] RegisterClipboardFormatW (lpszFormat="FileNameW") returned 0xc007 [0199.064] RegisterClipboardFormatW (lpszFormat="Rich Text Format") returned 0xc0b2 [0199.064] RegisterClipboardFormatW (lpszFormat="RichEdit Text and Objects") returned 0xc0b8 [0199.064] RegisterClipboardFormatW (lpszFormat="commdlg_FindReplace") returned 0xc103 [0199.064] __dllonexit () returned 0x6f0d4842 [0199.064] __dllonexit () returned 0x6f0d4851 [0199.065] __dllonexit () returned 0x6f0d4860 [0199.065] __dllonexit () returned 0x6f0d486f [0199.065] __dllonexit () returned 0x6f0d487e [0199.065] GetCursorPos (in: lpPoint=0x6f1b0418 | out: lpPoint=0x6f1b0418*(x=968, y=255)) returned 1 [0199.066] LocalAlloc (uFlags=0x40, uBytes=0x84) returned 0x6674d8 [0199.066] LocalReAlloc (hMem=0x666ef8, uBytes=0xc, uFlags=0x2) returned 0x6671f0 [0199.066] GetCurrentThread () returned 0xfffffffe [0199.066] GetCurrentThreadId () returned 0x324 [0199.066] __dllonexit () returned 0x6f0d47ac [0199.066] SetErrorMode (uMode=0x0) returned 0x8001 [0199.066] SetErrorMode (uMode=0x8001) returned 0x0 [0199.066] GetModuleFileNameW (in: hModule=0x6f0b0000, lpFilename=0x226bcc, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\MFC42u.dll" (normalized: "c:\\windows\\syswow64\\mfc42u.dll")) returned 0x1e [0199.066] wcscpy_s (in: _Destination=0x226dd4, _SizeInWords=0x104, _Source="MFC42u" | out: _Destination="MFC42u") returned 0x0 [0199.067] FindResourceW (hModule=0x6f0b0000, lpName=0xe01, lpType=0x6) returned 0x1209b0 [0199.131] LoadStringW (in: hInstance=0x6f0b0000, uID=0xe000, lpBuffer=0x2269cc, cchBufferMax=256 | out: lpBuffer="") returned 0x0 [0199.131] wcscpy_s (in: _Destination=0x226c00, _SizeInWords=0x5, _Source=".HLP" | out: _Destination=".HLP") returned 0x0 [0199.131] wcscat_s (in: _Destination="MFC42u", _SizeInWords=0x104, _Source=".INI" | out: _Destination="MFC42u.INI") returned 0x0 [0199.131] malloc (_Size=0x40) returned 0x372628 [0199.132] LocalAlloc (uFlags=0x40, uBytes=0x2090) returned 0x669d68 [0199.132] GetSystemDirectoryA (in: lpBuffer=0x227018, uSize=0x112 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0199.132] strcat_s (in: _Destination="C:\\Windows\\system32", _SizeInBytes=0x112, _Source="\\MFC42" | out: _Destination="C:\\Windows\\system32\\MFC42") returned 0x0 [0199.132] strcat_s (in: _Destination="C:\\Windows\\system32\\MFC42", _SizeInBytes=0x112, _Source="LOC" | out: _Destination="C:\\Windows\\system32\\MFC42LOC") returned 0x0 [0199.132] strcat_s (in: _Destination="C:\\Windows\\system32\\MFC42LOC", _SizeInBytes=0x112, _Source=".DLL" | out: _Destination="C:\\Windows\\system32\\MFC42LOC.DLL") returned 0x0 [0199.132] LoadLibraryExA (lpLibFileName="C:\\Windows\\system32\\MFC42LOC.DLL", hFile=0x0, dwFlags=0x2) returned 0x0 [0199.135] GetProcAddress (hModule=0x6f2c0000, lpProcName="InitHelperDll") returned 0x6f2d6cb9 [0199.146] InitHelperDll () returned 0x0 [0199.146] RegisterHelper () returned 0x0 [0199.146] GetProcessHeap () returned 0x650000 [0199.146] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xd8) returned 0x66be00 [0199.146] GetProcessHeap () returned 0x650000 [0199.146] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x667280 | out: hHeap=0x650000) returned 1 [0199.146] RegisterHelper () returned 0x0 [0199.146] GetProcessHeap () returned 0x650000 [0199.146] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x120) returned 0x66bee0 [0199.146] GetProcessHeap () returned 0x650000 [0199.146] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x66be00 | out: hHeap=0x650000) returned 1 [0199.147] RegisterHelper () returned 0x0 [0199.147] GetProcessHeap () returned 0x650000 [0199.147] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x168) returned 0x66c008 [0199.147] GetProcessHeap () returned 0x650000 [0199.147] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x66bee0 | out: hHeap=0x650000) returned 1 [0199.147] RegisterHelper () returned 0x0 [0199.147] GetProcessHeap () returned 0x650000 [0199.147] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x1b0) returned 0x66be00 [0199.147] GetProcessHeap () returned 0x650000 [0199.147] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x66c008 | out: hHeap=0x650000) returned 1 [0199.150] RegisterHelper () returned 0x0 [0199.150] GetProcessHeap () returned 0x650000 [0199.150] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x1f8) returned 0x66bfb8 [0199.150] GetProcessHeap () returned 0x650000 [0199.150] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x66be00 | out: hHeap=0x650000) returned 1 [0199.150] RegEnumValueW (in: hKey=0xb0, dwIndex=0x1, lpValueName=0x667230, lpcchValueName=0x227508, lpReserved=0x0, lpType=0x0, lpData=0x667250, lpcbData=0x22750c | out: lpValueName="nshwfp", lpcchValueName=0x227508, lpType=0x0, lpData=0x667250, lpcbData=0x22750c) returned 0x0 [0199.150] _wcsicmp (_String1="nshwfp.dll", _String2="ipxmontr.dll") returned 5 [0199.150] _wcsicmp (_String1="nshwfp.dll", _String2="ipxpromn.dll") returned 5 [0199.150] GetProcessHeap () returned 0x650000 [0199.150] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x3c) returned 0x6679b0 [0199.150] GetProcessHeap () returned 0x650000 [0199.150] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xe) returned 0x668bc0 [0199.150] GetProcessHeap () returned 0x650000 [0199.150] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x16) returned 0x6677a8 [0199.150] _wcsupr (in: _String="nshwfp.dll" | out: _String="NSHWFP.DLL") returned="NSHWFP.DLL" [0199.150] GetProcessHeap () returned 0x650000 [0199.150] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x667318 | out: hHeap=0x650000) returned 1 [0199.150] LoadLibraryW (lpLibFileName="NSHWFP.DLL") returned 0x6ebe0000 [0200.542] GetProcAddress (hModule=0x6ebe0000, lpProcName="InitHelperDll") returned 0x6ec3bbb2 [0200.542] InitHelperDll () returned 0x0 [0200.542] RegisterHelper () returned 0x0 [0200.542] GetProcessHeap () returned 0x650000 [0200.542] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x240) returned 0x671920 [0200.542] GetProcessHeap () returned 0x650000 [0200.542] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x66bfb8 | out: hHeap=0x650000) returned 1 [0200.542] RegEnumValueW (in: hKey=0xb0, dwIndex=0x2, lpValueName=0x667230, lpcchValueName=0x227508, lpReserved=0x0, lpType=0x0, lpData=0x667250, lpcbData=0x22750c | out: lpValueName="dhcpclient", lpcchValueName=0x227508, lpType=0x0, lpData=0x667250, lpcbData=0x22750c) returned 0x0 [0200.542] _wcsicmp (_String1="dhcpcmonitor.dll", _String2="ipxmontr.dll") returned -5 [0200.542] _wcsicmp (_String1="dhcpcmonitor.dll", _String2="ipxpromn.dll") returned -5 [0200.542] GetProcessHeap () returned 0x650000 [0200.542] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x50) returned 0x66bfb8 [0200.542] GetProcessHeap () returned 0x650000 [0200.542] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x16) returned 0x6672d0 [0200.542] GetProcessHeap () returned 0x650000 [0200.542] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x22) returned 0x670d20 [0200.542] _wcsupr (in: _String="dhcpcmonitor.dll" | out: _String="DHCPCMONITOR.DLL") returned="DHCPCMONITOR.DLL" [0200.542] GetProcessHeap () returned 0x650000 [0200.542] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6679b0 | out: hHeap=0x650000) returned 1 [0200.542] LoadLibraryW (lpLibFileName="DHCPCMONITOR.DLL") returned 0x732a0000 [0203.145] GetProcAddress (hModule=0x732a0000, lpProcName="InitHelperDll") returned 0x732a1cd4 [0203.145] InitHelperDll () returned 0x0 [0203.145] RegisterHelper () returned 0x0 [0203.145] GetProcessHeap () returned 0x650000 [0203.145] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x288) returned 0x675488 [0203.145] GetProcessHeap () returned 0x650000 [0203.145] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x671920 | out: hHeap=0x650000) returned 1 [0203.146] RegEnumValueW (in: hKey=0xb0, dwIndex=0x3, lpValueName=0x667230, lpcchValueName=0x227508, lpReserved=0x0, lpType=0x0, lpData=0x667250, lpcbData=0x22750c | out: lpValueName="wshelper", lpcchValueName=0x227508, lpType=0x0, lpData=0x667250, lpcbData=0x22750c) returned 0x0 [0203.146] _wcsicmp (_String1="wshelper.dll", _String2="ipxmontr.dll") returned 14 [0203.146] _wcsicmp (_String1="wshelper.dll", _String2="ipxpromn.dll") returned 14 [0203.146] GetProcessHeap () returned 0x650000 [0203.146] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x64) returned 0x671920 [0203.146] GetProcessHeap () returned 0x650000 [0203.146] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x12) returned 0x672de8 [0203.146] GetProcessHeap () returned 0x650000 [0203.146] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x1a) returned 0x6724f0 [0203.146] _wcsupr (in: _String="wshelper.dll" | out: _String="WSHELPER.DLL") returned="WSHELPER.DLL" [0203.146] GetProcessHeap () returned 0x650000 [0203.146] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x66bfb8 | out: hHeap=0x650000) returned 1 [0203.146] LoadLibraryW (lpLibFileName="WSHELPER.DLL") returned 0x6f060000 [0204.532] GetProcAddress (hModule=0x6f060000, lpProcName="InitHelperDll") returned 0x6f06157b [0204.532] InitHelperDll () returned 0x0 [0204.551] RegisterHelper () returned 0x0 [0204.551] GetProcessHeap () returned 0x650000 [0204.551] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x2d0) returned 0x6768a8 [0204.551] GetProcessHeap () returned 0x650000 [0204.551] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x675488 | out: hHeap=0x650000) returned 1 [0204.551] RegEnumValueW (in: hKey=0xb0, dwIndex=0x4, lpValueName=0x667230, lpcchValueName=0x227508, lpReserved=0x0, lpType=0x0, lpData=0x667250, lpcbData=0x22750c | out: lpValueName="nshhttp", lpcchValueName=0x227508, lpType=0x0, lpData=0x667250, lpcbData=0x22750c) returned 0x0 [0204.551] _wcsicmp (_String1="nshhttp.dll", _String2="ipxmontr.dll") returned 5 [0204.551] _wcsicmp (_String1="nshhttp.dll", _String2="ipxpromn.dll") returned 5 [0204.551] GetProcessHeap () returned 0x650000 [0204.551] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x78) returned 0x6602a8 [0204.551] GetProcessHeap () returned 0x650000 [0204.551] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x674630 [0204.551] GetProcessHeap () returned 0x650000 [0204.551] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x18) returned 0x672e28 [0204.551] _wcsupr (in: _String="nshhttp.dll" | out: _String="NSHHTTP.DLL") returned="NSHHTTP.DLL" [0204.551] GetProcessHeap () returned 0x650000 [0204.551] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x671920 | out: hHeap=0x650000) returned 1 [0204.551] LoadLibraryW (lpLibFileName="NSHHTTP.DLL") returned 0x6f040000 [0205.090] GetProcAddress (hModule=0x6f040000, lpProcName="InitHelperDll") returned 0x6f041b47 [0205.090] InitHelperDll () returned 0x0 [0205.090] RegisterHelper () returned 0x0 [0205.090] GetProcessHeap () returned 0x650000 [0205.090] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x318) returned 0x677380 [0205.091] GetProcessHeap () returned 0x650000 [0205.091] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6768a8 | out: hHeap=0x650000) returned 1 [0205.091] RegEnumValueW (in: hKey=0xb0, dwIndex=0x5, lpValueName=0x667230, lpcchValueName=0x227508, lpReserved=0x0, lpType=0x0, lpData=0x667250, lpcbData=0x22750c | out: lpValueName="fwcfg", lpcchValueName=0x227508, lpType=0x0, lpData=0x667250, lpcbData=0x22750c) returned 0x0 [0205.091] _wcsicmp (_String1="fwcfg.dll", _String2="ipxmontr.dll") returned -3 [0205.091] _wcsicmp (_String1="fwcfg.dll", _String2="ipxpromn.dll") returned -3 [0205.091] GetProcessHeap () returned 0x650000 [0205.091] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8c) returned 0x671ab8 [0205.091] GetProcessHeap () returned 0x650000 [0205.091] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x676be0 [0205.091] GetProcessHeap () returned 0x650000 [0205.091] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x14) returned 0x672e48 [0205.091] _wcsupr (in: _String="fwcfg.dll" | out: _String="FWCFG.DLL") returned="FWCFG.DLL" [0205.091] GetProcessHeap () returned 0x650000 [0205.091] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6602a8 | out: hHeap=0x650000) returned 1 [0205.091] LoadLibraryW (lpLibFileName="FWCFG.DLL") returned 0x6f090000 [0206.270] GetProcAddress (hModule=0x6f090000, lpProcName="InitHelperDll") returned 0x6f092a30 [0206.270] InitHelperDll () returned 0x0 [0206.270] RegisterHelper () returned 0x0 [0206.270] GetProcessHeap () returned 0x650000 [0206.270] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x360) returned 0x679ea0 [0206.271] GetProcessHeap () returned 0x650000 [0206.271] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x677380 | out: hHeap=0x650000) returned 1 [0206.271] RegEnumValueW (in: hKey=0xb0, dwIndex=0x6, lpValueName=0x667230, lpcchValueName=0x227508, lpReserved=0x0, lpType=0x0, lpData=0x667250, lpcbData=0x22750c | out: lpValueName="authfwcfg", lpcchValueName=0x227508, lpType=0x0, lpData=0x667250, lpcbData=0x22750c) returned 0x0 [0206.271] _wcsicmp (_String1="authfwcfg.dll", _String2="ipxmontr.dll") returned -8 [0206.271] _wcsicmp (_String1="authfwcfg.dll", _String2="ipxpromn.dll") returned -8 [0206.271] GetProcessHeap () returned 0x650000 [0206.271] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa0) returned 0x675560 [0206.271] GetProcessHeap () returned 0x650000 [0206.271] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x14) returned 0x672e68 [0206.271] GetProcessHeap () returned 0x650000 [0206.271] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x1c) returned 0x679730 [0206.271] _wcsupr (in: _String="authfwcfg.dll" | out: _String="AUTHFWCFG.DLL") returned="AUTHFWCFG.DLL" [0206.271] GetProcessHeap () returned 0x650000 [0206.271] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x671ab8 | out: hHeap=0x650000) returned 1 [0206.271] LoadLibraryW (lpLibFileName="AUTHFWCFG.DLL") returned 0x6edd0000 [0207.354] GetProcAddress (hModule=0x6edd0000, lpProcName="InitHelperDll") returned 0x6edd4420 [0207.354] InitHelperDll () returned 0x0 [0207.362] RegisterHelper () returned 0x0 [0207.362] GetProcessHeap () returned 0x650000 [0207.362] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x3a8) returned 0x67a9b8 [0207.362] GetProcessHeap () returned 0x650000 [0207.362] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x679ea0 | out: hHeap=0x650000) returned 1 [0207.362] RegisterHelper () returned 0x0 [0207.362] GetProcessHeap () returned 0x650000 [0207.362] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x3f0) returned 0x67ad68 [0207.362] GetProcessHeap () returned 0x650000 [0207.362] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x67a9b8 | out: hHeap=0x650000) returned 1 [0207.362] RegisterHelper () returned 0x0 [0207.362] GetProcessHeap () returned 0x650000 [0207.362] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x438) returned 0x67b160 [0207.362] GetProcessHeap () returned 0x650000 [0207.363] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x67ad68 | out: hHeap=0x650000) returned 1 [0207.363] RegisterHelper () returned 0x0 [0207.363] GetProcessHeap () returned 0x650000 [0207.363] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x480) returned 0x67a9b8 [0207.363] GetProcessHeap () returned 0x650000 [0207.363] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x67b160 | out: hHeap=0x650000) returned 1 [0207.363] RegisterHelper () returned 0x0 [0207.363] GetProcessHeap () returned 0x650000 [0207.363] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x4c8) returned 0x67ae40 [0207.363] GetProcessHeap () returned 0x650000 [0207.363] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x67a9b8 | out: hHeap=0x650000) returned 1 [0207.363] RegEnumValueW (in: hKey=0xb0, dwIndex=0x7, lpValueName=0x667230, lpcchValueName=0x227508, lpReserved=0x0, lpType=0x0, lpData=0x667250, lpcbData=0x22750c | out: lpValueName="2", lpcchValueName=0x227508, lpType=0x0, lpData=0x667250, lpcbData=0x22750c) returned 0x0 [0207.363] _wcsicmp (_String1="ifmon.dll", _String2="ipxmontr.dll") returned -10 [0207.363] _wcsicmp (_String1="ifmon.dll", _String2="ipxpromn.dll") returned -10 [0207.363] GetProcessHeap () returned 0x650000 [0207.363] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xb4) returned 0x675608 [0207.363] GetProcessHeap () returned 0x650000 [0207.363] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x4) returned 0x666fd8 [0207.363] GetProcessHeap () returned 0x650000 [0207.363] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x14) returned 0x672f28 [0207.363] _wcsupr (in: _String="ifmon.dll" | out: _String="IFMON.DLL") returned="IFMON.DLL" [0207.363] GetProcessHeap () returned 0x650000 [0207.363] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x675560 | out: hHeap=0x650000) returned 1 [0207.363] LoadLibraryW (lpLibFileName="IFMON.DLL") returned 0x6f2f0000 [0207.935] GetProcAddress (hModule=0x6f2f0000, lpProcName="InitHelperDll") returned 0x6f2f17a3 [0207.935] InitHelperDll () returned 0x0 [0207.935] RegisterHelper () returned 0x0 [0207.935] GetProcessHeap () returned 0x650000 [0207.935] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x510) returned 0x67b310 [0207.935] GetProcessHeap () returned 0x650000 [0207.935] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x67ae40 | out: hHeap=0x650000) returned 1 [0207.935] RegEnumValueW (in: hKey=0xb0, dwIndex=0x8, lpValueName=0x667230, lpcchValueName=0x227508, lpReserved=0x0, lpType=0x0, lpData=0x667250, lpcbData=0x22750c | out: lpValueName="netiohlp", lpcchValueName=0x227508, lpType=0x0, lpData=0x667250, lpcbData=0x22750c) returned 0x0 [0207.935] _wcsicmp (_String1="netiohlp.dll", _String2="ipxmontr.dll") returned 5 [0207.935] _wcsicmp (_String1="netiohlp.dll", _String2="ipxpromn.dll") returned 5 [0207.935] GetProcessHeap () returned 0x650000 [0207.935] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc8) returned 0x676950 [0207.935] GetProcessHeap () returned 0x650000 [0207.935] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x12) returned 0x673048 [0207.935] GetProcessHeap () returned 0x650000 [0207.935] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x1a) returned 0x679e10 [0207.935] _wcsupr (in: _String="netiohlp.dll" | out: _String="NETIOHLP.DLL") returned="NETIOHLP.DLL" [0207.935] GetProcessHeap () returned 0x650000 [0207.935] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x675608 | out: hHeap=0x650000) returned 1 [0207.935] LoadLibraryW (lpLibFileName="NETIOHLP.DLL") returned 0x6eda0000 [0208.363] GetProcAddress (hModule=0x6eda0000, lpProcName="InitHelperDll") returned 0x6edb6e4b [0208.363] InitHelperDll () returned 0x0 [0208.363] RegisterHelper () returned 0x0 [0208.363] GetProcessHeap () returned 0x650000 [0208.363] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x558) returned 0x67c028 [0208.363] GetProcessHeap () returned 0x650000 [0208.363] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x67b310 | out: hHeap=0x650000) returned 1 [0208.363] RegisterHelper () returned 0x0 [0208.363] GetProcessHeap () returned 0x650000 [0208.363] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x5a0) returned 0x67b220 [0208.363] GetProcessHeap () returned 0x650000 [0208.363] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x67c028 | out: hHeap=0x650000) returned 1 [0208.363] RegisterHelper () returned 0x0 [0208.363] GetProcessHeap () returned 0x650000 [0208.363] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x5e8) returned 0x67c028 [0208.363] GetProcessHeap () returned 0x650000 [0208.363] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x67b220 | out: hHeap=0x650000) returned 1 [0208.363] RegisterHelper () returned 0x0 [0208.363] GetProcessHeap () returned 0x650000 [0208.363] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x630) returned 0x67c618 [0208.363] GetProcessHeap () returned 0x650000 [0208.363] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x67c028 | out: hHeap=0x650000) returned 1 [0208.363] RegisterHelper () returned 0x0 [0208.363] GetProcessHeap () returned 0x650000 [0208.364] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x678) returned 0x67cc50 [0208.364] GetProcessHeap () returned 0x650000 [0208.364] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x67c618 | out: hHeap=0x650000) returned 1 [0208.364] RegisterHelper () returned 0x0 [0208.364] GetProcessHeap () returned 0x650000 [0208.364] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x6c0) returned 0x67c028 [0208.364] GetProcessHeap () returned 0x650000 [0208.364] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x67cc50 | out: hHeap=0x650000) returned 1 [0208.364] RegisterHelper () returned 0x0 [0208.364] GetProcessHeap () returned 0x650000 [0208.364] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x708) returned 0x67c6f0 [0208.364] GetProcessHeap () returned 0x650000 [0208.364] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x67c028 | out: hHeap=0x650000) returned 1 [0208.364] RegisterHelper () returned 0x0 [0208.364] GetProcessHeap () returned 0x650000 [0208.364] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x750) returned 0x67ce00 [0208.364] GetProcessHeap () returned 0x650000 [0208.364] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x67c6f0 | out: hHeap=0x650000) returned 1 [0208.364] RegisterHelper () returned 0x0 [0208.364] GetProcessHeap () returned 0x650000 [0208.364] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x798) returned 0x67d558 [0208.364] GetProcessHeap () returned 0x650000 [0208.364] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x67ce00 | out: hHeap=0x650000) returned 1 [0208.364] RegEnumValueW (in: hKey=0xb0, dwIndex=0x9, lpValueName=0x667230, lpcchValueName=0x227508, lpReserved=0x0, lpType=0x0, lpData=0x667250, lpcbData=0x22750c | out: lpValueName="whhelper", lpcchValueName=0x227508, lpType=0x0, lpData=0x667250, lpcbData=0x22750c) returned 0x0 [0208.364] _wcsicmp (_String1="whhelper.dll", _String2="ipxmontr.dll") returned 14 [0208.364] _wcsicmp (_String1="whhelper.dll", _String2="ipxpromn.dll") returned 14 [0208.365] GetProcessHeap () returned 0x650000 [0208.365] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xdc) returned 0x6755c8 [0208.365] GetProcessHeap () returned 0x650000 [0208.365] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x12) returned 0x673068 [0208.365] GetProcessHeap () returned 0x650000 [0208.365] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x1a) returned 0x67b908 [0208.365] _wcsupr (in: _String="whhelper.dll" | out: _String="WHHELPER.DLL") returned="WHHELPER.DLL" [0208.365] GetProcessHeap () returned 0x650000 [0208.365] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x676950 | out: hHeap=0x650000) returned 1 [0208.365] LoadLibraryW (lpLibFileName="WHHELPER.DLL") returned 0x6ef70000 [0209.302] GetProcAddress (hModule=0x6ef70000, lpProcName="InitHelperDll") returned 0x6ef71c99 [0209.302] InitHelperDll () returned 0x0 [0209.302] RegisterHelper () returned 0x0 [0209.302] GetProcessHeap () returned 0x650000 [0209.302] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x7e0) returned 0x67c028 [0209.302] GetProcessHeap () returned 0x650000 [0209.302] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x67d558 | out: hHeap=0x650000) returned 1 [0209.302] RegEnumValueW (in: hKey=0xb0, dwIndex=0xa, lpValueName=0x667230, lpcchValueName=0x227508, lpReserved=0x0, lpType=0x0, lpData=0x667250, lpcbData=0x22750c | out: lpValueName="hnetmon", lpcchValueName=0x227508, lpType=0x0, lpData=0x667250, lpcbData=0x22750c) returned 0x0 [0209.302] _wcsicmp (_String1="hnetmon.dll", _String2="ipxmontr.dll") returned -1 [0209.302] _wcsicmp (_String1="hnetmon.dll", _String2="ipxpromn.dll") returned -1 [0209.302] GetProcessHeap () returned 0x650000 [0209.302] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xf0) returned 0x676950 [0209.302] GetProcessHeap () returned 0x650000 [0209.302] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x67b180 [0209.303] GetProcessHeap () returned 0x650000 [0209.303] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x18) returned 0x673088 [0209.303] _wcsupr (in: _String="hnetmon.dll" | out: _String="HNETMON.DLL") returned="HNETMON.DLL" [0209.303] GetProcessHeap () returned 0x650000 [0209.303] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6755c8 | out: hHeap=0x650000) returned 1 [0209.303] LoadLibraryW (lpLibFileName="HNETMON.DLL") returned 0x6ef40000 [0210.115] GetProcAddress (hModule=0x6ef40000, lpProcName="InitHelperDll") returned 0x6ef4200c [0210.115] InitHelperDll () returned 0x0 [0210.115] RegisterHelper () returned 0x0 [0210.115] GetProcessHeap () returned 0x650000 [0210.115] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x828) returned 0x67c810 [0210.115] GetProcessHeap () returned 0x650000 [0210.115] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x67c028 | out: hHeap=0x650000) returned 1 [0210.115] RegEnumValueW (in: hKey=0xb0, dwIndex=0xb, lpValueName=0x667230, lpcchValueName=0x227508, lpReserved=0x0, lpType=0x0, lpData=0x667250, lpcbData=0x22750c | out: lpValueName="rpc", lpcchValueName=0x227508, lpType=0x0, lpData=0x667250, lpcbData=0x22750c) returned 0x0 [0210.115] _wcsicmp (_String1="rpcnsh.dll", _String2="ipxmontr.dll") returned 9 [0210.115] _wcsicmp (_String1="rpcnsh.dll", _String2="ipxpromn.dll") returned 9 [0210.115] GetProcessHeap () returned 0x650000 [0210.115] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x104) returned 0x676a48 [0210.115] GetProcessHeap () returned 0x650000 [0210.115] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8) returned 0x667048 [0210.115] GetProcessHeap () returned 0x650000 [0210.115] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x16) returned 0x6730a8 [0210.115] _wcsupr (in: _String="rpcnsh.dll" | out: _String="RPCNSH.DLL") returned="RPCNSH.DLL" [0210.115] GetProcessHeap () returned 0x650000 [0210.115] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x676950 | out: hHeap=0x650000) returned 1 [0210.115] LoadLibraryW (lpLibFileName="RPCNSH.DLL") returned 0x6ef10000 [0210.422] GetProcAddress (hModule=0x6ef10000, lpProcName="InitHelperDll") returned 0x6ef12f94 [0210.422] InitHelperDll () returned 0x0 [0210.422] RegisterHelper () returned 0x0 [0210.422] GetProcessHeap () returned 0x650000 [0210.422] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x870) returned 0x67d040 [0210.422] GetProcessHeap () returned 0x650000 [0210.422] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x67c810 | out: hHeap=0x650000) returned 1 [0210.422] RegisterHelper () returned 0x0 [0210.422] GetProcessHeap () returned 0x650000 [0210.422] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x8b8) returned 0x67c028 [0210.422] GetProcessHeap () returned 0x650000 [0210.422] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x67d040 | out: hHeap=0x650000) returned 1 [0210.422] RegEnumValueW (in: hKey=0xb0, dwIndex=0xc, lpValueName=0x667230, lpcchValueName=0x227508, lpReserved=0x0, lpType=0x0, lpData=0x667250, lpcbData=0x22750c | out: lpValueName="dot3cfg", lpcchValueName=0x227508, lpType=0x0, lpData=0x667250, lpcbData=0x22750c) returned 0x0 [0210.422] _wcsicmp (_String1="dot3cfg.dll", _String2="ipxmontr.dll") returned -5 [0210.422] _wcsicmp (_String1="dot3cfg.dll", _String2="ipxpromn.dll") returned -5 [0210.422] GetProcessHeap () returned 0x650000 [0210.422] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x118) returned 0x677380 [0210.422] GetProcessHeap () returned 0x650000 [0210.422] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x67b4f0 [0210.422] GetProcessHeap () returned 0x650000 [0210.422] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x18) returned 0x6730c8 [0210.423] _wcsupr (in: _String="dot3cfg.dll" | out: _String="DOT3CFG.DLL") returned="DOT3CFG.DLL" [0210.423] GetProcessHeap () returned 0x650000 [0210.423] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x676a48 | out: hHeap=0x650000) returned 1 [0210.423] LoadLibraryW (lpLibFileName="DOT3CFG.DLL") returned 0x6ebb0000 [0212.278] GetProcAddress (hModule=0x6ebb0000, lpProcName="InitHelperDll") returned 0x6ebba31d [0212.278] InitHelperDll () returned 0x0 [0212.278] RegisterHelper () returned 0x0 [0212.278] GetProcessHeap () returned 0x650000 [0212.278] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x900) returned 0x67d4e8 [0212.278] GetProcessHeap () returned 0x650000 [0212.278] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x67c028 | out: hHeap=0x650000) returned 1 [0212.278] RegEnumValueW (in: hKey=0xb0, dwIndex=0xd, lpValueName=0x667230, lpcchValueName=0x227508, lpReserved=0x0, lpType=0x0, lpData=0x667250, lpcbData=0x22750c | out: lpValueName="napmontr", lpcchValueName=0x227508, lpType=0x0, lpData=0x667250, lpcbData=0x22750c) returned 0x0 [0212.278] _wcsicmp (_String1="napmontr.dll", _String2="ipxmontr.dll") returned 5 [0212.278] _wcsicmp (_String1="napmontr.dll", _String2="ipxpromn.dll") returned 5 [0212.278] GetProcessHeap () returned 0x650000 [0212.278] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x12c) returned 0x67ddf0 [0212.278] GetProcessHeap () returned 0x650000 [0212.278] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x12) returned 0x6730e8 [0212.278] GetProcessHeap () returned 0x650000 [0212.279] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x1a) returned 0x67d048 [0212.279] _wcsupr (in: _String="napmontr.dll" | out: _String="NAPMONTR.DLL") returned="NAPMONTR.DLL" [0212.279] GetProcessHeap () returned 0x650000 [0212.279] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x677380 | out: hHeap=0x650000) returned 1 [0212.279] LoadLibraryW (lpLibFileName="NAPMONTR.DLL") returned 0x6d760000 [0212.991] GetProcAddress (hModule=0x6d760000, lpProcName="InitHelperDll") returned 0x6d76c7d5 [0212.991] InitHelperDll () returned 0x0 [0212.991] RegisterHelper () returned 0x0 [0212.991] GetProcessHeap () returned 0x650000 [0212.991] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x948) returned 0x67e7b0 [0212.991] GetProcessHeap () returned 0x650000 [0212.991] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x67d4e8 | out: hHeap=0x650000) returned 1 [0212.991] RegisterHelper () returned 0x0 [0212.991] GetProcessHeap () returned 0x650000 [0212.991] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x990) returned 0x67f100 [0212.991] GetProcessHeap () returned 0x650000 [0212.991] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x67e7b0 | out: hHeap=0x650000) returned 1 [0212.992] RegisterHelper () returned 0x0 [0212.992] GetProcessHeap () returned 0x650000 [0212.992] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x9d8) returned 0x67fa98 [0212.992] GetProcessHeap () returned 0x650000 [0212.992] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x67f100 | out: hHeap=0x650000) returned 1 [0212.992] RegEnumValueW (in: hKey=0xb0, dwIndex=0xe, lpValueName=0x667230, lpcchValueName=0x227508, lpReserved=0x0, lpType=0x0, lpData=0x667250, lpcbData=0x22750c | out: lpValueName="nshipsec", lpcchValueName=0x227508, lpType=0x0, lpData=0x667250, lpcbData=0x22750c) returned 0x0 [0212.992] _wcsicmp (_String1="nshipsec.dll", _String2="ipxmontr.dll") returned 5 [0212.992] _wcsicmp (_String1="nshipsec.dll", _String2="ipxpromn.dll") returned 5 [0212.992] GetProcessHeap () returned 0x650000 [0212.992] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x140) returned 0x6774a8 [0212.992] GetProcessHeap () returned 0x650000 [0212.992] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x12) returned 0x673128 [0212.992] GetProcessHeap () returned 0x650000 [0212.992] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x1a) returned 0x67e0b8 [0212.992] _wcsupr (in: _String="nshipsec.dll" | out: _String="NSHIPSEC.DLL") returned="NSHIPSEC.DLL" [0212.992] GetProcessHeap () returned 0x650000 [0212.992] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x67ddf0 | out: hHeap=0x650000) returned 1 [0212.992] LoadLibraryW (lpLibFileName="NSHIPSEC.DLL") returned 0x6d690000 [0214.368] GetProcAddress (hModule=0x6d690000, lpProcName="InitHelperDll") returned 0x6d696910 [0214.368] InitHelperDll () returned 0x0 [0214.368] RegisterHelper () returned 0x0 [0214.368] GetProcessHeap () returned 0x650000 [0214.368] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa20) returned 0x67d4e8 [0214.368] GetProcessHeap () returned 0x650000 [0214.369] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x67fa98 | out: hHeap=0x650000) returned 1 [0214.369] RegisterHelper () returned 0x0 [0214.369] GetProcessHeap () returned 0x650000 [0214.369] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa68) returned 0x682478 [0214.369] GetProcessHeap () returned 0x650000 [0214.369] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x67d4e8 | out: hHeap=0x650000) returned 1 [0214.369] RegisterHelper () returned 0x0 [0214.369] GetProcessHeap () returned 0x650000 [0214.369] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xab0) returned 0x67f8e8 [0214.369] GetProcessHeap () returned 0x650000 [0214.369] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x682478 | out: hHeap=0x650000) returned 1 [0214.421] RegEnumValueW (in: hKey=0xb0, dwIndex=0xf, lpValueName=0x667230, lpcchValueName=0x227508, lpReserved=0x0, lpType=0x0, lpData=0x667250, lpcbData=0x22750c | out: lpValueName="p2pnetsh", lpcchValueName=0x227508, lpType=0x0, lpData=0x667250, lpcbData=0x22750c) returned 0x0 [0214.421] _wcsicmp (_String1="p2pnetsh.dll", _String2="ipxmontr.dll") returned 7 [0214.421] _wcsicmp (_String1="p2pnetsh.dll", _String2="ipxpromn.dll") returned 7 [0214.421] GetProcessHeap () returned 0x650000 [0214.421] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x154) returned 0x6832c8 [0214.421] GetProcessHeap () returned 0x650000 [0214.421] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x12) returned 0x67d7d8 [0214.421] GetProcessHeap () returned 0x650000 [0214.421] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x1a) returned 0x682870 [0214.421] _wcsupr (in: _String="p2pnetsh.dll" | out: _String="P2PNETSH.DLL") returned="P2PNETSH.DLL" [0214.421] GetProcessHeap () returned 0x650000 [0214.421] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6774a8 | out: hHeap=0x650000) returned 1 [0214.422] LoadLibraryW (lpLibFileName="P2PNETSH.DLL") returned 0x6d4d0000 [0215.375] GetProcAddress (hModule=0x6d4d0000, lpProcName="InitHelperDll") returned 0x6d4d38e5 [0215.375] InitHelperDll () returned 0x0 [0215.375] RegisterHelper () returned 0x0 [0215.375] GetProcessHeap () returned 0x650000 [0215.375] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xaf8) returned 0x68a138 [0215.375] GetProcessHeap () returned 0x650000 [0215.375] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x67f8e8 | out: hHeap=0x650000) returned 1 [0215.375] RegisterHelper () returned 0x0 [0215.375] GetProcessHeap () returned 0x650000 [0215.375] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xb40) returned 0x68ac38 [0215.375] GetProcessHeap () returned 0x650000 [0215.376] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68a138 | out: hHeap=0x650000) returned 1 [0215.376] RegisterHelper () returned 0x0 [0215.376] GetProcessHeap () returned 0x650000 [0215.376] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xb88) returned 0x68b780 [0215.376] GetProcessHeap () returned 0x650000 [0215.376] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68ac38 | out: hHeap=0x650000) returned 1 [0215.376] RegisterHelper () returned 0x0 [0215.376] GetProcessHeap () returned 0x650000 [0215.376] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xbd0) returned 0x68c310 [0215.376] GetProcessHeap () returned 0x650000 [0215.376] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68b780 | out: hHeap=0x650000) returned 1 [0215.376] RegisterHelper () returned 0x0 [0215.376] GetProcessHeap () returned 0x650000 [0215.376] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc18) returned 0x68a138 [0215.376] GetProcessHeap () returned 0x650000 [0215.376] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68c310 | out: hHeap=0x650000) returned 1 [0215.376] RegisterHelper () returned 0x0 [0215.376] GetProcessHeap () returned 0x650000 [0215.376] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc60) returned 0x68ad58 [0215.376] GetProcessHeap () returned 0x650000 [0215.376] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68a138 | out: hHeap=0x650000) returned 1 [0215.376] RegisterHelper () returned 0x0 [0215.376] GetProcessHeap () returned 0x650000 [0215.376] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xca8) returned 0x68b9c0 [0215.377] GetProcessHeap () returned 0x650000 [0215.377] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68ad58 | out: hHeap=0x650000) returned 1 [0215.377] RegisterHelper () returned 0x0 [0215.377] GetProcessHeap () returned 0x650000 [0215.377] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xcf0) returned 0x68a138 [0215.377] GetProcessHeap () returned 0x650000 [0215.377] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68b9c0 | out: hHeap=0x650000) returned 1 [0215.377] RegisterHelper () returned 0x0 [0215.377] GetProcessHeap () returned 0x650000 [0215.377] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xd38) returned 0x68ae30 [0215.377] GetProcessHeap () returned 0x650000 [0215.377] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68a138 | out: hHeap=0x650000) returned 1 [0215.377] RegisterHelper () returned 0x0 [0215.377] GetProcessHeap () returned 0x650000 [0215.377] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xd80) returned 0x68bb70 [0215.377] GetProcessHeap () returned 0x650000 [0215.377] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68ae30 | out: hHeap=0x650000) returned 1 [0215.377] RegEnumValueW (in: hKey=0xb0, dwIndex=0x10, lpValueName=0x667230, lpcchValueName=0x227508, lpReserved=0x0, lpType=0x0, lpData=0x667250, lpcbData=0x22750c | out: lpValueName="wlancfg", lpcchValueName=0x227508, lpType=0x0, lpData=0x667250, lpcbData=0x22750c) returned 0x0 [0215.377] _wcsicmp (_String1="wlancfg.dll", _String2="ipxmontr.dll") returned 14 [0215.377] _wcsicmp (_String1="wlancfg.dll", _String2="ipxpromn.dll") returned 14 [0215.377] GetProcessHeap () returned 0x650000 [0215.377] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x168) returned 0x685710 [0215.377] GetProcessHeap () returned 0x650000 [0215.377] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x683288 [0215.377] GetProcessHeap () returned 0x650000 [0215.377] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x18) returned 0x67d7f8 [0215.378] _wcsupr (in: _String="wlancfg.dll" | out: _String="WLANCFG.DLL") returned="WLANCFG.DLL" [0215.378] GetProcessHeap () returned 0x650000 [0215.378] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6832c8 | out: hHeap=0x650000) returned 1 [0215.378] LoadLibraryW (lpLibFileName="WLANCFG.DLL") returned 0x6d3f0000 [0216.029] GetProcAddress (hModule=0x6d3f0000, lpProcName="InitHelperDll") returned 0x6d3fc7d8 [0216.029] InitHelperDll () returned 0x0 [0216.029] RegisterHelper () returned 0x0 [0216.029] GetProcessHeap () returned 0x650000 [0216.029] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xdc8) returned 0x68a138 [0216.029] GetProcessHeap () returned 0x650000 [0216.029] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68bb70 | out: hHeap=0x650000) returned 1 [0216.029] RegEnumValueW (in: hKey=0xb0, dwIndex=0x11, lpValueName=0x667230, lpcchValueName=0x227508, lpReserved=0x0, lpType=0x0, lpData=0x667250, lpcbData=0x22750c | out: lpValueName="peerdistsh", lpcchValueName=0x227508, lpType=0x0, lpData=0x667250, lpcbData=0x22750c) returned 0x0 [0216.029] _wcsicmp (_String1="peerdistsh.dll", _String2="ipxmontr.dll") returned 7 [0216.029] _wcsicmp (_String1="peerdistsh.dll", _String2="ipxpromn.dll") returned 7 [0216.029] GetProcessHeap () returned 0x650000 [0216.029] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x17c) returned 0x6832c8 [0216.029] GetProcessHeap () returned 0x650000 [0216.029] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x16) returned 0x67d818 [0216.029] GetProcessHeap () returned 0x650000 [0216.029] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x1e) returned 0x689e00 [0216.029] _wcsupr (in: _String="peerdistsh.dll" | out: _String="PEERDISTSH.DLL") returned="PEERDISTSH.DLL" [0216.029] GetProcessHeap () returned 0x650000 [0216.029] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x685710 | out: hHeap=0x650000) returned 1 [0216.029] LoadLibraryW (lpLibFileName="PEERDISTSH.DLL") returned 0x6d2f0000 [0216.232] GetProcAddress (hModule=0x6d2f0000, lpProcName="InitHelperDll") returned 0x6d36c796 [0216.233] InitHelperDll () returned 0x0 [0216.233] RegisterHelper () returned 0x0 [0216.233] GetProcessHeap () returned 0x650000 [0216.233] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xe10) returned 0x68af08 [0216.233] GetProcessHeap () returned 0x650000 [0216.233] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68a138 | out: hHeap=0x650000) returned 1 [0216.233] RegisterHelper () returned 0x0 [0216.233] GetProcessHeap () returned 0x650000 [0216.233] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xe58) returned 0x68ef80 [0216.233] GetProcessHeap () returned 0x650000 [0216.233] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68af08 | out: hHeap=0x650000) returned 1 [0216.233] RegCloseKey (hKey=0xb0) returned 0x0 [0216.233] GetProcessHeap () returned 0x650000 [0216.233] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x667230 | out: hHeap=0x650000) returned 1 [0216.233] GetProcessHeap () returned 0x650000 [0216.233] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x667250 | out: hHeap=0x650000) returned 1 [0216.235] GetProcessHeap () returned 0x650000 [0216.235] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x48) returned 0x685a90 [0216.235] GetProcessHeap () returned 0x650000 [0216.235] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x650000) returned 1 [0216.235] RegisterContext () returned 0x0 [0216.237] GetProcessHeap () returned 0x650000 [0216.237] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x48) returned 0x685ae0 [0216.237] GetProcessHeap () returned 0x650000 [0216.237] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x650000) returned 1 [0216.248] RegisterContext () returned 0x0 [0216.248] GetProcessHeap () returned 0x650000 [0216.249] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x48) returned 0x685b30 [0216.249] GetProcessHeap () returned 0x650000 [0216.249] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x650000) returned 1 [0216.249] RegisterContext () returned 0x0 [0216.249] _wcsicmp (_String1="ipv6", _String2="ip") returned 118 [0216.249] _wcsicmp (_String1="ipv6", _String2="ip") returned 118 [0216.249] GetProcessHeap () returned 0x650000 [0216.249] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x90) returned 0x685878 [0216.249] GetProcessHeap () returned 0x650000 [0216.249] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x685b30 | out: hHeap=0x650000) returned 1 [0216.251] RegisterContext () returned 0x0 [0216.251] _wcsicmp (_String1="aaaa", _String2="ip") returned -8 [0216.251] _wcsicmp (_String1="aaaa", _String2="ipv6") returned -8 [0216.251] _wcsicmp (_String1="aaaa", _String2="ip") returned -8 [0216.251] GetProcessHeap () returned 0x650000 [0216.251] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xd8) returned 0x680230 [0216.252] GetProcessHeap () returned 0x650000 [0216.252] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x685878 | out: hHeap=0x650000) returned 1 [0216.252] RegisterContext () returned 0x0 [0216.252] GetProcessHeap () returned 0x650000 [0216.253] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x680230 | out: hHeap=0x650000) returned 1 [0216.253] RegisterContext () returned 0x0 [0216.253] GetProcessHeap () returned 0x650000 [0216.253] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x685ae0 | out: hHeap=0x650000) returned 1 [0216.253] RegisterContext () returned 0x0 [0216.253] GetProcessHeap () returned 0x650000 [0216.253] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x685878 | out: hHeap=0x650000) returned 1 [0216.253] RegisterContext () returned 0x0 [0216.253] GetProcessHeap () returned 0x650000 [0216.253] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x680230 | out: hHeap=0x650000) returned 1 [0216.254] RegisterContext () returned 0x0 [0216.254] GetProcessHeap () returned 0x650000 [0216.254] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x693d08 | out: hHeap=0x650000) returned 1 [0216.261] RegisterContext () returned 0x0 [0216.261] GetProcessHeap () returned 0x650000 [0216.261] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x680230 | out: hHeap=0x650000) returned 1 [0216.262] RegisterContext () returned 0x0 [0216.262] GetProcessHeap () returned 0x650000 [0216.262] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x693d08 | out: hHeap=0x650000) returned 1 [0216.262] RegisterContext () returned 0x0 [0216.262] GetProcessHeap () returned 0x650000 [0216.262] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x650000) returned 1 [0216.262] RegisterContext () returned 0x0 [0216.263] GetProcessHeap () returned 0x650000 [0216.263] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x685ae0 | out: hHeap=0x650000) returned 1 [0216.263] RegisterContext () returned 0x0 [0216.263] GetProcessHeap () returned 0x650000 [0216.263] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x685878 | out: hHeap=0x650000) returned 1 [0216.263] RegisterContext () returned 0x0 [0216.263] GetProcessHeap () returned 0x650000 [0216.263] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x680230 | out: hHeap=0x650000) returned 1 [0216.263] RegisterContext () returned 0x0 [0216.263] GetProcessHeap () returned 0x650000 [0216.263] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68aec0 | out: hHeap=0x650000) returned 1 [0216.263] RegisterContext () returned 0x0 [0216.263] GetProcessHeap () returned 0x650000 [0216.263] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68b0c0 | out: hHeap=0x650000) returned 1 [0216.264] RegisterContext () returned 0x0 [0216.264] GetProcessHeap () returned 0x650000 [0216.264] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68b308 | out: hHeap=0x650000) returned 1 [0216.264] RegisterContext () returned 0x0 [0216.264] GetProcessHeap () returned 0x650000 [0216.264] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68aec0 | out: hHeap=0x650000) returned 1 [0216.265] RegisterContext () returned 0x0 [0216.265] GetProcessHeap () returned 0x650000 [0216.265] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x650000) returned 1 [0216.265] RegisterContext () returned 0x0 [0216.265] GetProcessHeap () returned 0x650000 [0216.265] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x685ae0 | out: hHeap=0x650000) returned 1 [0216.266] RegisterContext () returned 0x0 [0216.266] GetProcessHeap () returned 0x650000 [0216.266] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x685878 | out: hHeap=0x650000) returned 1 [0216.266] RegisterContext () returned 0x0 [0216.266] GetProcessHeap () returned 0x650000 [0216.266] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x680230 | out: hHeap=0x650000) returned 1 [0216.266] RegisterContext () returned 0x0 [0216.266] GetProcessHeap () returned 0x650000 [0216.266] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x693e30 | out: hHeap=0x650000) returned 1 [0216.266] RegisterContext () returned 0x0 [0216.266] GetProcessHeap () returned 0x650000 [0216.266] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x680230 | out: hHeap=0x650000) returned 1 [0216.266] RegisterContext () returned 0x0 [0216.267] GetProcessHeap () returned 0x650000 [0216.267] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x650000) returned 1 [0216.267] RegisterContext () returned 0x0 [0216.267] GetProcessHeap () returned 0x650000 [0216.267] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x685ae0 | out: hHeap=0x650000) returned 1 [0216.267] RegisterContext () returned 0x0 [0216.267] RegisterContext () returned 0x0 [0216.267] GetProcessHeap () returned 0x650000 [0216.267] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x693e30 | out: hHeap=0x650000) returned 1 [0216.267] RegisterContext () returned 0x0 [0216.267] GetProcessHeap () returned 0x650000 [0216.267] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68aec0 | out: hHeap=0x650000) returned 1 [0216.267] RegisterContext () returned 0x0 [0216.267] GetProcessHeap () returned 0x650000 [0216.267] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68b198 | out: hHeap=0x650000) returned 1 [0216.267] RegisterContext () returned 0x0 [0216.267] GetProcessHeap () returned 0x650000 [0216.268] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68b700 | out: hHeap=0x650000) returned 1 [0216.268] RegisterContext () returned 0x0 [0216.268] GetProcessHeap () returned 0x650000 [0216.268] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68aec0 | out: hHeap=0x650000) returned 1 [0216.268] RegisterContext () returned 0x0 [0216.268] GetProcessHeap () returned 0x650000 [0216.268] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x650000) returned 1 [0216.268] RegisterContext () returned 0x0 [0216.268] GetProcessHeap () returned 0x650000 [0216.268] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68b700 | out: hHeap=0x650000) returned 1 [0216.295] RegisterContext () returned 0x0 [0216.296] GetProcessHeap () returned 0x650000 [0216.296] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68aec0 | out: hHeap=0x650000) returned 1 [0216.427] RegisterContext () returned 0x0 [0216.427] GetProcessHeap () returned 0x650000 [0216.427] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x650000) returned 1 [0216.437] RegisterContext () returned 0x0 [0216.437] GetProcessHeap () returned 0x650000 [0216.437] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x685fe0 | out: hHeap=0x650000) returned 1 [0216.437] RegisterContext () returned 0x0 [0216.437] GetProcessHeap () returned 0x650000 [0216.437] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x698778 | out: hHeap=0x650000) returned 1 [0216.437] RegisterContext () returned 0x0 [0216.437] GetProcessHeap () returned 0x650000 [0216.437] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x650000) returned 1 [0216.438] RegisterContext () returned 0x0 [0216.438] GetProcessHeap () returned 0x650000 [0216.438] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x685fe0 | out: hHeap=0x650000) returned 1 [0216.438] RegisterContext () returned 0x0 [0216.438] RegisterContext () returned 0x0 [0216.438] RegisterContext () returned 0x0 [0216.439] GetProcessHeap () returned 0x650000 [0216.439] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6a9ad0 | out: hHeap=0x650000) returned 1 [0216.439] RegisterContext () returned 0x0 [0216.439] GetProcessHeap () returned 0x650000 [0216.439] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x650000) returned 1 [0216.443] RegisterContext () returned 0x0 [0216.444] GetProcessHeap () returned 0x650000 [0216.444] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x685fe0 | out: hHeap=0x650000) returned 1 [0216.444] RegisterContext () returned 0x0 [0216.444] GetProcessHeap () returned 0x650000 [0216.444] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x698b60 | out: hHeap=0x650000) returned 1 [0216.444] RegisterContext () returned 0x0 [0216.444] GetProcessHeap () returned 0x650000 [0216.444] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x698810 | out: hHeap=0x650000) returned 1 [0216.444] RegisterContext () returned 0x0 [0216.444] GetProcessHeap () returned 0x650000 [0216.444] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x650000) returned 1 [0216.444] RegisterContext () returned 0x0 [0216.444] GetProcessHeap () returned 0x650000 [0216.444] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x685fe0 | out: hHeap=0x650000) returned 1 [0216.444] RegisterContext () returned 0x0 [0216.444] GetProcessHeap () returned 0x650000 [0216.444] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x698b60 | out: hHeap=0x650000) returned 1 [0216.444] RegisterContext () returned 0x0 [0216.444] GetProcessHeap () returned 0x650000 [0216.444] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x650000) returned 1 [0216.445] RegisterContext () returned 0x0 [0216.445] GetProcessHeap () returned 0x650000 [0216.445] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x650000) returned 1 [0216.445] RegisterContext () returned 0x0 [0216.445] GetProcessHeap () returned 0x650000 [0216.445] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6a9fa0 | out: hHeap=0x650000) returned 1 [0216.500] RegisterContext () returned 0x0 [0216.500] GetProcessHeap () returned 0x650000 [0216.500] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6aa5c8 | out: hHeap=0x650000) returned 1 [0216.500] RegisterContext () returned 0x0 [0216.500] GetProcessHeap () returned 0x650000 [0216.500] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x650000) returned 1 [0216.500] SetConsoleCtrlHandler (HandlerRoutine=0x17e7c89, Add=1) returned 1 [0216.500] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x76a20000 [0216.501] GetProcAddress (hModule=0x76a20000, lpProcName="SetThreadUILanguage") returned 0x76a4a84f [0216.501] SetThreadUILanguage (LangId=0x0) returned 0x409 [0216.501] FreeLibrary (hLibModule=0x76a20000) returned 1 [0216.501] _wcsicmp (_String1="wlan", _String2="-?") returned 74 [0216.501] _wcsicmp (_String1="wlan", _String2="-h") returned 74 [0216.501] _wcsicmp (_String1="wlan", _String2="?") returned 56 [0216.501] _wcsicmp (_String1="wlan", _String2="/?") returned 72 [0216.501] _wcsicmp (_String1="wlan", _String2="-v") returned 74 [0216.501] _wcsicmp (_String1="wlan", _String2="-a") returned 74 [0216.501] _wcsicmp (_String1="wlan", _String2="-c") returned 74 [0216.501] _wcsicmp (_String1="wlan", _String2="-f") returned 74 [0216.501] _wcsicmp (_String1="wlan", _String2="-r") returned 74 [0216.501] _wcsicmp (_String1="wlan", _String2="-u") returned 74 [0216.501] _wcsicmp (_String1="wlan", _String2="-p") returned 74 [0216.501] GetVersionExW (in: lpVersionInformation=0x2273f8*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x2273f8*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0216.502] _vsnwprintf (in: _Buffer=0x17eb338, _BufferCount=0x103, _Format="%d.%d.%d", _ArgList=0x2273e4 | out: _Buffer="6.1.7601") returned 8 [0216.502] _vsnwprintf (in: _Buffer=0x17eb748, _BufferCount=0x103, _Format="%d", _ArgList=0x2273d4 | out: _Buffer="7601") returned 4 [0216.502] _vsnwprintf (in: _Buffer=0x17eb540, _BufferCount=0x103, _Format="%d", _ArgList=0x2273c4 | out: _Buffer="1") returned 1 [0216.502] _vsnwprintf (in: _Buffer=0x17eb950, _BufferCount=0x103, _Format="%d", _ArgList=0x2273b4 | out: _Buffer="0") returned 1 [0216.502] GetProcessHeap () returned 0x650000 [0216.502] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x69e828 [0216.502] GetProcessHeap () returned 0x650000 [0216.502] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x69e840 [0216.502] GetProcessHeap () returned 0x650000 [0216.502] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x69e858 [0216.502] GetProcessHeap () returned 0x650000 [0216.502] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x69e870 [0216.502] GetProcessHeap () returned 0x650000 [0216.502] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x69e888 [0216.502] wcscpy_s (in: _Destination=0x69e888, _SizeInWords=0x6, _Source="netsh" | out: _Destination="netsh") returned 0x0 [0216.502] GetProcessHeap () returned 0x650000 [0216.502] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x69e858 | out: hHeap=0x650000) returned 1 [0216.502] GetProcessHeap () returned 0x650000 [0216.502] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x69e840 | out: hHeap=0x650000) returned 1 [0216.502] GetProcessHeap () returned 0x650000 [0216.502] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x69e840 [0216.502] GetProcessHeap () returned 0x650000 [0216.502] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x69e858 [0216.502] GetProcessHeap () returned 0x650000 [0216.502] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x24) returned 0x69dec0 [0216.502] GetProcessHeap () returned 0x650000 [0216.502] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x69e8a0 [0216.502] GetProcessHeap () returned 0x650000 [0216.502] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x69e8b8 [0216.502] wcscpy_s (in: _Destination=0x69e8b8, _SizeInWords=0x5, _Source="wlan" | out: _Destination="wlan") returned 0x0 [0216.502] GetProcessHeap () returned 0x650000 [0216.502] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x69e8d0 [0216.502] GetProcessHeap () returned 0x650000 [0216.502] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x69e8e8 [0216.502] wcscpy_s (in: _Destination=0x69e8e8, _SizeInWords=0x5, _Source="show" | out: _Destination="show") returned 0x0 [0216.502] GetProcessHeap () returned 0x650000 [0216.502] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x69e900 [0216.503] GetProcessHeap () returned 0x650000 [0216.503] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x69e918 [0216.503] wcscpy_s (in: _Destination=0x69e918, _SizeInWords=0x8, _Source="profile" | out: _Destination="profile") returned 0x0 [0216.503] GetProcessHeap () returned 0x650000 [0216.503] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x69dec0 | out: hHeap=0x650000) returned 1 [0216.503] GetProcessHeap () returned 0x650000 [0216.503] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x69e858 | out: hHeap=0x650000) returned 1 [0216.503] GetProcessHeap () returned 0x650000 [0216.503] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x69e858 [0216.503] GetProcessHeap () returned 0x650000 [0216.503] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x69e930 [0216.503] wcscpy_s (in: _Destination=0x69e930, _SizeInWords=0x5, _Source="wlan" | out: _Destination="wlan") returned 0x0 [0216.503] GetProcessHeap () returned 0x650000 [0216.503] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x69e8b8 | out: hHeap=0x650000) returned 1 [0216.503] GetProcessHeap () returned 0x650000 [0216.503] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x69e8a0 | out: hHeap=0x650000) returned 1 [0216.503] GetProcessHeap () returned 0x650000 [0216.503] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x69e8a0 [0216.503] GetProcessHeap () returned 0x650000 [0216.503] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x69e8b8 [0216.503] wcscpy_s (in: _Destination=0x69e8b8, _SizeInWords=0x5, _Source="wlan" | out: _Destination="wlan") returned 0x0 [0216.503] GetProcessHeap () returned 0x650000 [0216.503] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x69e930 | out: hHeap=0x650000) returned 1 [0216.503] GetProcessHeap () returned 0x650000 [0216.503] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x69e858 | out: hHeap=0x650000) returned 1 [0216.503] GetProcessHeap () returned 0x650000 [0216.503] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x69e858 [0216.503] GetProcessHeap () returned 0x650000 [0216.503] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x69e930 [0216.503] wcscpy_s (in: _Destination=0x69e930, _SizeInWords=0x5, _Source="show" | out: _Destination="show") returned 0x0 [0216.503] GetProcessHeap () returned 0x650000 [0216.503] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x69e8e8 | out: hHeap=0x650000) returned 1 [0216.503] GetProcessHeap () returned 0x650000 [0216.503] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x69e8d0 | out: hHeap=0x650000) returned 1 [0216.503] GetProcessHeap () returned 0x650000 [0216.503] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x69e8d0 [0216.503] GetProcessHeap () returned 0x650000 [0216.503] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x69e8e8 [0216.503] wcscpy_s (in: _Destination=0x69e8e8, _SizeInWords=0x8, _Source="profile" | out: _Destination="profile") returned 0x0 [0216.503] GetProcessHeap () returned 0x650000 [0216.504] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x69e918 | out: hHeap=0x650000) returned 1 [0216.504] GetProcessHeap () returned 0x650000 [0216.504] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x69e900 | out: hHeap=0x650000) returned 1 [0216.504] GetProcessHeap () returned 0x650000 [0216.504] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x69e900 [0216.504] GetProcessHeap () returned 0x650000 [0216.504] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x69e918 [0216.504] GetProcessHeap () returned 0x650000 [0216.504] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x69e948 [0216.504] GetProcessHeap () returned 0x650000 [0216.504] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x69e960 [0216.504] GetProcessHeap () returned 0x650000 [0216.504] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x69e978 [0216.504] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x69e990, Size=0xe) returned 0x69e9a8 [0216.504] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x69e9a8, Size=0x16) returned 0x69a560 [0216.504] GetProcessHeap () returned 0x650000 [0216.504] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x69a560, Size=0x18) returned 0x69a580 [0216.504] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x69a580, Size=0x20) returned 0x6aafc8 [0216.504] GetProcessHeap () returned 0x650000 [0216.504] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6aafc8, Size=0x22) returned 0x69dec0 [0216.504] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x69dec0, Size=0x30) returned 0x6a92c0 [0216.505] GetProcessHeap () returned 0x650000 [0216.505] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6a92c0 | out: hHeap=0x650000) returned 1 [0216.505] _wcsnicmp (_String1="wlan", _String2="dump", _MaxCount=0x4) returned 19 [0216.505] _wcsnicmp (_String1="wlan", _String2="help", _MaxCount=0x4) returned 15 [0216.505] _wcsnicmp (_String1="wlan", _String2="?", _MaxCount=0x4) returned 56 [0216.505] _wcsnicmp (_String1="wlan", _String2="exec", _MaxCount=0x4) returned 18 [0216.505] _wcsnicmp (_String1="wlan", _String2="advf", _MaxCount=0x4) returned 22 [0216.505] _wcsnicmp (_String1="wlan", _String2="bran", _MaxCount=0x4) returned 21 [0216.505] _wcsnicmp (_String1="wlan", _String2="brid", _MaxCount=0x4) returned 21 [0216.505] _wcsnicmp (_String1="wlan", _String2="dhcp", _MaxCount=0x4) returned 19 [0216.505] _wcsnicmp (_String1="wlan", _String2="dnsc", _MaxCount=0x4) returned 19 [0216.505] _wcsnicmp (_String1="wlan", _String2="fire", _MaxCount=0x4) returned 17 [0216.505] _wcsnicmp (_String1="wlan", _String2="http", _MaxCount=0x4) returned 15 [0216.505] _wcsnicmp (_String1="wlan", _String2="inte", _MaxCount=0x4) returned 14 [0216.505] _wcsnicmp (_String1="wlan", _String2="ipse", _MaxCount=0x4) returned 14 [0216.505] _wcsnicmp (_String1="wlan", _String2="lan", _MaxCount=0x4) returned 11 [0216.505] _wcsnicmp (_String1="wlan", _String2="name", _MaxCount=0x4) returned 9 [0216.506] _wcsnicmp (_String1="wlan", _String2="nap", _MaxCount=0x4) returned 9 [0216.506] _wcsnicmp (_String1="wlan", _String2="neti", _MaxCount=0x4) returned 9 [0216.506] _wcsnicmp (_String1="wlan", _String2="p2p", _MaxCount=0x4) returned 7 [0216.506] _wcsnicmp (_String1="wlan", _String2="ras", _MaxCount=0x4) returned 5 [0216.506] _wcsnicmp (_String1="wlan", _String2="rpc", _MaxCount=0x4) returned 5 [0216.506] _wcsnicmp (_String1="wlan", _String2="wfp", _MaxCount=0x4) returned 6 [0216.506] _wcsnicmp (_String1="wlan", _String2="winh", _MaxCount=0x4) returned 3 [0216.506] _wcsnicmp (_String1="wlan", _String2="wins", _MaxCount=0x4) returned 3 [0216.506] _wcsnicmp (_String1="wlan", _String2="wlan", _MaxCount=0x4) returned 0 [0216.506] GetProcessHeap () returned 0x650000 [0216.506] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x69e9a8 [0216.506] GetProcessHeap () returned 0x650000 [0216.506] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x69e990 [0216.506] GetProcessHeap () returned 0x650000 [0216.506] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x30) returned 0x6a92c0 [0216.506] GetProcessHeap () returned 0x650000 [0216.506] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x69e9c0 [0216.506] GetProcessHeap () returned 0x650000 [0216.506] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x69e9d8 [0216.506] wcscpy_s (in: _Destination=0x69e9d8, _SizeInWords=0x6, _Source="netsh" | out: _Destination="netsh") returned 0x0 [0216.506] GetProcessHeap () returned 0x650000 [0216.506] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x69e9f0 [0216.506] GetProcessHeap () returned 0x650000 [0216.506] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x69ea08 [0216.506] wcscpy_s (in: _Destination=0x69ea08, _SizeInWords=0x5, _Source="wlan" | out: _Destination="wlan") returned 0x0 [0216.506] GetProcessHeap () returned 0x650000 [0216.506] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x69ea20 [0216.506] GetProcessHeap () returned 0x650000 [0216.506] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x69ea38 [0216.506] wcscpy_s (in: _Destination=0x69ea38, _SizeInWords=0x5, _Source="show" | out: _Destination="show") returned 0x0 [0216.506] GetProcessHeap () returned 0x650000 [0216.506] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xc) returned 0x69ea50 [0216.506] GetProcessHeap () returned 0x650000 [0216.506] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x69ea68 [0216.506] wcscpy_s (in: _Destination=0x69ea68, _SizeInWords=0x8, _Source="profile" | out: _Destination="profile") returned 0x0 [0216.506] GetProcessHeap () returned 0x650000 [0216.506] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6a92c0 | out: hHeap=0x650000) returned 1 [0216.506] GetProcessHeap () returned 0x650000 [0216.507] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x69e990 | out: hHeap=0x650000) returned 1 [0216.507] GetProcessHeap () returned 0x650000 [0216.507] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x69ea08 | out: hHeap=0x650000) returned 1 [0216.507] GetProcessHeap () returned 0x650000 [0216.507] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xa) returned 0x69ea08 [0216.507] _wcsnicmp (_String1="show", _String2="dump", _MaxCount=0x4) returned 15 [0216.507] _wcsnicmp (_String1="show", _String2="help", _MaxCount=0x4) returned 11 [0216.507] _wcsnicmp (_String1="show", _String2="?", _MaxCount=0x4) returned 52 [0216.507] _wcsnicmp (_String1="show", _String2="conn", _MaxCount=0x4) returned 16 [0216.507] _wcsnicmp (_String1="show", _String2="disc", _MaxCount=0x4) returned 15 [0216.507] _wcsnicmp (_String1="show", _String2="repo", _MaxCount=0x4) returned 1 [0216.507] _wcsnicmp (_String1="show", _String2="add", _MaxCount=0x4) returned 18 [0216.507] _wcsnicmp (_String1="show", _String2="dele", _MaxCount=0x4) returned 15 [0216.507] _wcsnicmp (_String1="show", _String2="set", _MaxCount=0x4) returned 3 [0216.507] _wcsnicmp (_String1="show", _String2="show", _MaxCount=0x4) returned 0 [0216.507] _wcsnicmp (_String1="profile", _String2="help", _MaxCount=0x7) returned 8 [0216.507] _wcsnicmp (_String1="profile", _String2="?", _MaxCount=0x7) returned 49 [0216.507] wcstok (in: _String="settings", _Delimiter=" ", _Context=0x0 | out: _String="settings", _Context=0x0) returned="settings" [0216.507] _wcsnicmp (_String1="profile", _String2="setting", _MaxCount=0x7) returned -3 [0216.507] wcstok (in: _String="interfaces", _Delimiter=" ", _Context=0x1 | out: _String="interfaces", _Context=0x1) returned="interfaces" [0216.507] _wcsnicmp (_String1="profile", _String2="interfa", _MaxCount=0x7) returned 7 [0216.507] wcstok (in: _String="networks", _Delimiter=" ", _Context=0x2 | out: _String="networks", _Context=0x2) returned="networks" [0216.507] _wcsnicmp (_String1="profile", _String2="network", _MaxCount=0x7) returned 2 [0216.507] wcstok (in: _String="profiles", _Delimiter=" ", _Context=0x3 | out: _String="profiles", _Context=0x3) returned="profiles" [0216.507] _wcsnicmp (_String1="profile", _String2="profile", _MaxCount=0x7) returned 0 [0216.507] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x3 | out: _String=0x0, _Context=0x3) returned 0x0 [0216.514] PrintMessageFromModule () returned 0x39 [0216.514] LoadStringW (in: hInstance=0x6d3f0000, uID=0xe870, lpBuffer=0x222eb4, cchBufferMax=8192 | out: lpBuffer="The Wireless AutoConfig Service (wlansvc) is not running.") returned 0x39 [0216.522] FormatMessageW (in: dwFlags=0x500, lpSource=0x222eb4, dwMessageId=0x0, dwLanguageId=0x0, lpBuffer=0x222e90, nSize=0x0, Arguments=0x222eb0 | out: lpBuffer="ꗈj溼\"㜍ž⺴\"⺰\"") returned 0x39 [0216.522] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3f0 [0216.522] GetConsoleOutputCP () returned 0x1b5 [0216.523] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="The Wireless AutoConfig Service (wlansvc) is not running.", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 58 [0216.523] GetProcessHeap () returned 0x650000 [0216.523] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x3a) returned 0x67f1e8 [0216.523] GetConsoleOutputCP () returned 0x1b5 [0216.523] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="The Wireless AutoConfig Service (wlansvc) is not running.", cchWideChar=-1, lpMultiByteStr=0x67f1e8, cbMultiByte=58, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="The Wireless AutoConfig Service (wlansvc) is not running.", lpUsedDefaultChar=0x0) returned 58 [0216.523] WriteFile (in: hFile=0x3f0, lpBuffer=0x67f1e8*, nNumberOfBytesToWrite=0x39, lpNumberOfBytesWritten=0x222e6c, lpOverlapped=0x0 | out: lpBuffer=0x67f1e8*, lpNumberOfBytesWritten=0x222e6c*=0x39, lpOverlapped=0x0) returned 1 [0216.524] GetProcessHeap () returned 0x650000 [0216.524] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x67f1e8 | out: hHeap=0x650000) returned 1 [0216.524] LocalFree (hMem=0x6aa5c8) returned 0x0 [0216.524] FormatMessageW (in: dwFlags=0x500, lpSource=0x17e2008, dwMessageId=0x0, dwLanguageId=0x0, lpBuffer=0x2273f4, nSize=0x0, Arguments=0x227408 | out: lpBuffer="i琌\"㚪ž ž琈\"琘\"琘\"㙻ž ž瑠\"ダž") returned 0x2 [0216.524] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3f0 [0216.524] GetConsoleOutputCP () returned 0x1b5 [0216.524] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0216.524] GetProcessHeap () returned 0x650000 [0216.524] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x3) returned 0x698290 [0216.524] GetConsoleOutputCP () returned 0x1b5 [0216.524] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x698290, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0216.524] WriteFile (in: hFile=0x3f0, lpBuffer=0x698290*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2273d0, lpOverlapped=0x0 | out: lpBuffer=0x698290*, lpNumberOfBytesWritten=0x2273d0*=0x2, lpOverlapped=0x0) returned 1 [0216.524] GetProcessHeap () returned 0x650000 [0216.524] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x698290 | out: hHeap=0x650000) returned 1 [0216.524] LocalFree (hMem=0x69e990) returned 0x0 [0216.524] GetProcessHeap () returned 0x650000 [0216.525] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x69e918 | out: hHeap=0x650000) returned 1 [0216.525] GetProcessHeap () returned 0x650000 [0216.525] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x69e948 | out: hHeap=0x650000) returned 1 [0216.525] GetProcessHeap () returned 0x650000 [0216.525] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x69e960 | out: hHeap=0x650000) returned 1 [0216.525] GetProcessHeap () returned 0x650000 [0216.525] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x69e978 | out: hHeap=0x650000) returned 1 [0216.525] GetProcessHeap () returned 0x650000 [0216.525] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x69e900 | out: hHeap=0x650000) returned 1 [0216.525] GetProcessHeap () returned 0x650000 [0216.525] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x69e8b8 | out: hHeap=0x650000) returned 1 [0216.525] GetProcessHeap () returned 0x650000 [0216.525] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x69e8a0 | out: hHeap=0x650000) returned 1 [0216.525] GetProcessHeap () returned 0x650000 [0216.525] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x69e930 | out: hHeap=0x650000) returned 1 [0216.525] GetProcessHeap () returned 0x650000 [0216.525] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x69e858 | out: hHeap=0x650000) returned 1 [0216.525] GetProcessHeap () returned 0x650000 [0216.525] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x69e8e8 | out: hHeap=0x650000) returned 1 [0216.525] GetProcessHeap () returned 0x650000 [0216.525] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x69e8d0 | out: hHeap=0x650000) returned 1 [0216.525] GetProcessHeap () returned 0x650000 [0216.525] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x69e840 | out: hHeap=0x650000) returned 1 [0216.525] GetProcessHeap () returned 0x650000 [0216.525] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x69e888 | out: hHeap=0x650000) returned 1 [0216.525] GetProcessHeap () returned 0x650000 [0216.525] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x69e870 | out: hHeap=0x650000) returned 1 [0216.525] GetProcessHeap () returned 0x650000 [0216.525] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x69e828 | out: hHeap=0x650000) returned 1 [0216.535] GetProcessHeap () returned 0x650000 [0216.535] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x68ef80 | out: hHeap=0x650000) returned 1 [0216.535] FreeLibrary (hLibModule=0x17e0000) returned 1 [0216.535] FreeLibrary (hLibModule=0x6f2c0000) returned 1 [0216.540] free (_Block=0x372628) [0216.540] LocalAlloc (uFlags=0x40, uBytes=0x178) returned 0x6693e8 [0216.540] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x668ba8 [0216.540] LocalAlloc (uFlags=0x0, uBytes=0x10) returned 0x680080 [0216.540] free (_Block=0x373f90) [0216.540] free (_Block=0x0) [0216.540] free (_Block=0x373f78) [0216.540] free (_Block=0x3713b8) [0216.541] free (_Block=0x371400) [0216.541] LocalAlloc (uFlags=0x40, uBytes=0x84) returned 0x693e30 [0216.542] free (_Block=0x372520) [0216.542] GetModuleHandleA (lpModuleName="MSVCRT.DLL") returned 0x76970000 [0216.542] FreeLibrary (hLibModule=0x76970000) returned 1 [0216.542] GlobalHandle (pMem=0x667698) returned 0x2a0004 [0216.542] GlobalUnlock (hMem=0x2a0004) returned 0 [0216.550] FreeLibrary (hLibModule=0x6ebe0000) returned 1 [0216.551] FreeLibrary (hLibModule=0x732a0000) returned 1 [0216.552] FreeLibrary (hLibModule=0x6f060000) returned 1 [0216.556] FreeLibrary (hLibModule=0x6f040000) returned 1 [0216.556] FreeLibrary (hLibModule=0x6f090000) returned 1 [0216.557] FreeLibrary (hLibModule=0x6edd0000) returned 1 [0216.559] FreeLibrary (hLibModule=0x6f2f0000) returned 1 [0216.560] FreeLibrary (hLibModule=0x6eda0000) returned 1 [0216.562] FreeLibrary (hLibModule=0x6ef70000) returned 1 [0216.566] FreeLibrary (hLibModule=0x6ef40000) returned 1 [0216.573] FreeLibrary (hLibModule=0x6ef10000) returned 1 [0216.574] FreeLibrary (hLibModule=0x6ebb0000) returned 1 [0216.575] FreeLibrary (hLibModule=0x6d760000) returned 1 [0216.585] FreeLibrary (hLibModule=0x6d690000) returned 1 [0216.598] FreeLibrary (hLibModule=0x6d4d0000) returned 1 [0216.609] FreeLibrary (hLibModule=0x6d3f0000) returned 1 [0216.624] FreeLibrary (hLibModule=0x6d2f0000) returned 1 [0216.627] GetProcessHeap () returned 0x650000 [0216.627] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6832c8 | out: hHeap=0x650000) returned 1 [0216.627] GetProcessHeap () returned 0x650000 [0216.627] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666130 | out: hHeap=0x650000) returned 1 [0216.627] GetProcessHeap () returned 0x650000 [0216.628] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666140 | out: hHeap=0x650000) returned 1 [0216.628] GetProcessHeap () returned 0x650000 [0216.628] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666150 | out: hHeap=0x650000) returned 1 [0216.628] GetProcessHeap () returned 0x650000 [0216.628] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666160 | out: hHeap=0x650000) returned 1 [0216.628] GetProcessHeap () returned 0x650000 [0216.628] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666170 | out: hHeap=0x650000) returned 1 [0216.628] GetProcessHeap () returned 0x650000 [0216.628] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666180 | out: hHeap=0x650000) returned 1 [0216.628] GetProcessHeap () returned 0x650000 [0216.628] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666190 | out: hHeap=0x650000) returned 1 [0216.628] GetProcessHeap () returned 0x650000 [0216.628] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6661a0 | out: hHeap=0x650000) returned 1 [0216.628] GetProcessHeap () returned 0x650000 [0216.628] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6661b0 | out: hHeap=0x650000) returned 1 [0216.628] GetProcessHeap () returned 0x650000 [0216.628] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6661c0 | out: hHeap=0x650000) returned 1 [0216.628] GetProcessHeap () returned 0x650000 [0216.628] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6661d0 | out: hHeap=0x650000) returned 1 [0216.628] GetProcessHeap () returned 0x650000 [0216.628] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6661e0 | out: hHeap=0x650000) returned 1 [0216.628] GetProcessHeap () returned 0x650000 [0216.628] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666208 | out: hHeap=0x650000) returned 1 [0216.628] GetProcessHeap () returned 0x650000 [0216.628] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666218 | out: hHeap=0x650000) returned 1 [0216.628] GetProcessHeap () returned 0x650000 [0216.628] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666228 | out: hHeap=0x650000) returned 1 [0216.628] GetProcessHeap () returned 0x650000 [0216.628] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666238 | out: hHeap=0x650000) returned 1 [0216.628] GetProcessHeap () returned 0x650000 [0216.628] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666248 | out: hHeap=0x650000) returned 1 [0216.628] GetProcessHeap () returned 0x650000 [0216.628] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666258 | out: hHeap=0x650000) returned 1 [0216.628] GetProcessHeap () returned 0x650000 [0216.628] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666268 | out: hHeap=0x650000) returned 1 [0216.628] GetProcessHeap () returned 0x650000 [0216.628] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666278 | out: hHeap=0x650000) returned 1 [0216.628] GetProcessHeap () returned 0x650000 [0216.628] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666288 | out: hHeap=0x650000) returned 1 [0216.628] GetProcessHeap () returned 0x650000 [0216.628] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666298 | out: hHeap=0x650000) returned 1 [0216.628] GetProcessHeap () returned 0x650000 [0216.628] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6662a8 | out: hHeap=0x650000) returned 1 [0216.629] GetProcessHeap () returned 0x650000 [0216.629] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6662b8 | out: hHeap=0x650000) returned 1 [0216.629] GetProcessHeap () returned 0x650000 [0216.629] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6662c8 | out: hHeap=0x650000) returned 1 [0216.629] GetProcessHeap () returned 0x650000 [0216.629] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6662d8 | out: hHeap=0x650000) returned 1 [0216.629] GetProcessHeap () returned 0x650000 [0216.629] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6662e8 | out: hHeap=0x650000) returned 1 [0216.629] GetProcessHeap () returned 0x650000 [0216.629] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6662f8 | out: hHeap=0x650000) returned 1 [0216.629] GetProcessHeap () returned 0x650000 [0216.629] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666308 | out: hHeap=0x650000) returned 1 [0216.629] GetProcessHeap () returned 0x650000 [0216.629] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666318 | out: hHeap=0x650000) returned 1 [0216.629] GetProcessHeap () returned 0x650000 [0216.629] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666328 | out: hHeap=0x650000) returned 1 [0216.629] GetProcessHeap () returned 0x650000 [0216.629] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666338 | out: hHeap=0x650000) returned 1 [0216.629] GetProcessHeap () returned 0x650000 [0216.629] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666348 | out: hHeap=0x650000) returned 1 [0216.629] GetProcessHeap () returned 0x650000 [0216.629] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666358 | out: hHeap=0x650000) returned 1 [0216.629] GetProcessHeap () returned 0x650000 [0216.629] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666368 | out: hHeap=0x650000) returned 1 [0216.629] GetProcessHeap () returned 0x650000 [0216.629] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666378 | out: hHeap=0x650000) returned 1 [0216.629] GetProcessHeap () returned 0x650000 [0216.629] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666388 | out: hHeap=0x650000) returned 1 [0216.629] GetProcessHeap () returned 0x650000 [0216.629] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666398 | out: hHeap=0x650000) returned 1 [0216.629] GetProcessHeap () returned 0x650000 [0216.629] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6663a8 | out: hHeap=0x650000) returned 1 [0216.629] GetProcessHeap () returned 0x650000 [0216.629] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6663b8 | out: hHeap=0x650000) returned 1 [0216.629] GetProcessHeap () returned 0x650000 [0216.629] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6663c8 | out: hHeap=0x650000) returned 1 [0216.629] GetProcessHeap () returned 0x650000 [0216.629] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6663d8 | out: hHeap=0x650000) returned 1 [0216.629] GetProcessHeap () returned 0x650000 [0216.629] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6663e8 | out: hHeap=0x650000) returned 1 [0216.629] GetProcessHeap () returned 0x650000 [0216.629] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6663f8 | out: hHeap=0x650000) returned 1 [0216.629] GetProcessHeap () returned 0x650000 [0216.629] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666408 | out: hHeap=0x650000) returned 1 [0216.630] GetProcessHeap () returned 0x650000 [0216.630] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666418 | out: hHeap=0x650000) returned 1 [0216.630] GetProcessHeap () returned 0x650000 [0216.630] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666428 | out: hHeap=0x650000) returned 1 [0216.630] GetProcessHeap () returned 0x650000 [0216.630] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666438 | out: hHeap=0x650000) returned 1 [0216.630] GetProcessHeap () returned 0x650000 [0216.630] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666448 | out: hHeap=0x650000) returned 1 [0216.630] GetProcessHeap () returned 0x650000 [0216.630] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666458 | out: hHeap=0x650000) returned 1 [0216.630] GetProcessHeap () returned 0x650000 [0216.630] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666468 | out: hHeap=0x650000) returned 1 [0216.630] GetProcessHeap () returned 0x650000 [0216.630] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666478 | out: hHeap=0x650000) returned 1 [0216.630] GetProcessHeap () returned 0x650000 [0216.630] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666488 | out: hHeap=0x650000) returned 1 [0216.630] GetProcessHeap () returned 0x650000 [0216.630] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666498 | out: hHeap=0x650000) returned 1 [0216.630] GetProcessHeap () returned 0x650000 [0216.630] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6664a8 | out: hHeap=0x650000) returned 1 [0216.630] GetProcessHeap () returned 0x650000 [0216.630] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6664b8 | out: hHeap=0x650000) returned 1 [0216.630] GetProcessHeap () returned 0x650000 [0216.630] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6664c8 | out: hHeap=0x650000) returned 1 [0216.630] GetProcessHeap () returned 0x650000 [0216.630] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6664d8 | out: hHeap=0x650000) returned 1 [0216.630] GetProcessHeap () returned 0x650000 [0216.630] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6664e8 | out: hHeap=0x650000) returned 1 [0216.630] GetProcessHeap () returned 0x650000 [0216.630] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6664f8 | out: hHeap=0x650000) returned 1 [0216.630] GetProcessHeap () returned 0x650000 [0216.630] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666508 | out: hHeap=0x650000) returned 1 [0216.630] GetProcessHeap () returned 0x650000 [0216.630] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666518 | out: hHeap=0x650000) returned 1 [0216.630] GetProcessHeap () returned 0x650000 [0216.630] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666528 | out: hHeap=0x650000) returned 1 [0216.630] GetProcessHeap () returned 0x650000 [0216.630] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666538 | out: hHeap=0x650000) returned 1 [0216.630] GetProcessHeap () returned 0x650000 [0216.630] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666548 | out: hHeap=0x650000) returned 1 [0216.630] GetProcessHeap () returned 0x650000 [0216.630] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666558 | out: hHeap=0x650000) returned 1 [0216.630] GetProcessHeap () returned 0x650000 [0216.630] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666568 | out: hHeap=0x650000) returned 1 [0216.631] GetProcessHeap () returned 0x650000 [0216.631] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666578 | out: hHeap=0x650000) returned 1 [0216.631] GetProcessHeap () returned 0x650000 [0216.631] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666588 | out: hHeap=0x650000) returned 1 [0216.631] GetProcessHeap () returned 0x650000 [0216.631] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666598 | out: hHeap=0x650000) returned 1 [0216.631] GetProcessHeap () returned 0x650000 [0216.631] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6665a8 | out: hHeap=0x650000) returned 1 [0216.631] GetProcessHeap () returned 0x650000 [0216.631] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6665b8 | out: hHeap=0x650000) returned 1 [0216.631] GetProcessHeap () returned 0x650000 [0216.631] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6665c8 | out: hHeap=0x650000) returned 1 [0216.631] GetProcessHeap () returned 0x650000 [0216.631] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6665d8 | out: hHeap=0x650000) returned 1 [0216.631] GetProcessHeap () returned 0x650000 [0216.631] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666608 | out: hHeap=0x650000) returned 1 [0216.631] GetProcessHeap () returned 0x650000 [0216.631] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666618 | out: hHeap=0x650000) returned 1 [0216.631] GetProcessHeap () returned 0x650000 [0216.631] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666628 | out: hHeap=0x650000) returned 1 [0216.631] GetProcessHeap () returned 0x650000 [0216.631] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666638 | out: hHeap=0x650000) returned 1 [0216.631] GetProcessHeap () returned 0x650000 [0216.631] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666648 | out: hHeap=0x650000) returned 1 [0216.631] GetProcessHeap () returned 0x650000 [0216.631] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666658 | out: hHeap=0x650000) returned 1 [0216.631] GetProcessHeap () returned 0x650000 [0216.631] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666668 | out: hHeap=0x650000) returned 1 [0216.631] GetProcessHeap () returned 0x650000 [0216.631] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666678 | out: hHeap=0x650000) returned 1 [0216.631] GetProcessHeap () returned 0x650000 [0216.631] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666688 | out: hHeap=0x650000) returned 1 [0216.631] GetProcessHeap () returned 0x650000 [0216.631] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666698 | out: hHeap=0x650000) returned 1 [0216.631] GetProcessHeap () returned 0x650000 [0216.631] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6666a8 | out: hHeap=0x650000) returned 1 [0216.631] GetProcessHeap () returned 0x650000 [0216.631] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6666b8 | out: hHeap=0x650000) returned 1 [0216.631] GetProcessHeap () returned 0x650000 [0216.631] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6666c8 | out: hHeap=0x650000) returned 1 [0216.631] GetProcessHeap () returned 0x650000 [0216.631] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6666d8 | out: hHeap=0x650000) returned 1 [0216.631] GetProcessHeap () returned 0x650000 [0216.631] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6666e8 | out: hHeap=0x650000) returned 1 [0216.632] GetProcessHeap () returned 0x650000 [0216.632] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6666f8 | out: hHeap=0x650000) returned 1 [0216.632] GetProcessHeap () returned 0x650000 [0216.632] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666708 | out: hHeap=0x650000) returned 1 [0216.632] GetProcessHeap () returned 0x650000 [0216.632] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666718 | out: hHeap=0x650000) returned 1 [0216.632] GetProcessHeap () returned 0x650000 [0216.632] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666728 | out: hHeap=0x650000) returned 1 [0216.632] GetProcessHeap () returned 0x650000 [0216.632] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666738 | out: hHeap=0x650000) returned 1 [0216.632] GetProcessHeap () returned 0x650000 [0216.632] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666748 | out: hHeap=0x650000) returned 1 [0216.632] GetProcessHeap () returned 0x650000 [0216.632] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666758 | out: hHeap=0x650000) returned 1 [0216.632] GetProcessHeap () returned 0x650000 [0216.632] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666768 | out: hHeap=0x650000) returned 1 [0216.632] GetProcessHeap () returned 0x650000 [0216.632] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666778 | out: hHeap=0x650000) returned 1 [0216.632] GetProcessHeap () returned 0x650000 [0216.632] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666788 | out: hHeap=0x650000) returned 1 [0216.632] GetProcessHeap () returned 0x650000 [0216.632] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666798 | out: hHeap=0x650000) returned 1 [0216.632] GetProcessHeap () returned 0x650000 [0216.632] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6667a8 | out: hHeap=0x650000) returned 1 [0216.632] GetProcessHeap () returned 0x650000 [0216.632] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6667b8 | out: hHeap=0x650000) returned 1 [0216.632] GetProcessHeap () returned 0x650000 [0216.632] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6667c8 | out: hHeap=0x650000) returned 1 [0216.632] GetProcessHeap () returned 0x650000 [0216.632] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6667d8 | out: hHeap=0x650000) returned 1 [0216.632] GetProcessHeap () returned 0x650000 [0216.632] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6667e8 | out: hHeap=0x650000) returned 1 [0216.632] GetProcessHeap () returned 0x650000 [0216.632] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6667f8 | out: hHeap=0x650000) returned 1 [0216.632] GetProcessHeap () returned 0x650000 [0216.632] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666808 | out: hHeap=0x650000) returned 1 [0216.632] GetProcessHeap () returned 0x650000 [0216.632] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666818 | out: hHeap=0x650000) returned 1 [0216.632] GetProcessHeap () returned 0x650000 [0216.632] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666828 | out: hHeap=0x650000) returned 1 [0216.632] GetProcessHeap () returned 0x650000 [0216.632] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666838 | out: hHeap=0x650000) returned 1 [0216.633] GetProcessHeap () returned 0x650000 [0216.633] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666848 | out: hHeap=0x650000) returned 1 [0216.633] GetProcessHeap () returned 0x650000 [0216.633] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666858 | out: hHeap=0x650000) returned 1 [0216.633] GetProcessHeap () returned 0x650000 [0216.633] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666868 | out: hHeap=0x650000) returned 1 [0216.633] GetProcessHeap () returned 0x650000 [0216.633] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666878 | out: hHeap=0x650000) returned 1 [0216.633] GetProcessHeap () returned 0x650000 [0216.633] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666888 | out: hHeap=0x650000) returned 1 [0216.633] GetProcessHeap () returned 0x650000 [0216.633] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666898 | out: hHeap=0x650000) returned 1 [0216.633] GetProcessHeap () returned 0x650000 [0216.633] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6668a8 | out: hHeap=0x650000) returned 1 [0216.633] GetProcessHeap () returned 0x650000 [0216.633] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6668b8 | out: hHeap=0x650000) returned 1 [0216.633] GetProcessHeap () returned 0x650000 [0216.633] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6668c8 | out: hHeap=0x650000) returned 1 [0216.633] GetProcessHeap () returned 0x650000 [0216.633] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6668d8 | out: hHeap=0x650000) returned 1 [0216.633] GetProcessHeap () returned 0x650000 [0216.633] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6668e8 | out: hHeap=0x650000) returned 1 [0216.633] GetProcessHeap () returned 0x650000 [0216.633] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6668f8 | out: hHeap=0x650000) returned 1 [0216.633] GetProcessHeap () returned 0x650000 [0216.633] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666908 | out: hHeap=0x650000) returned 1 [0216.633] GetProcessHeap () returned 0x650000 [0216.633] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666918 | out: hHeap=0x650000) returned 1 [0216.633] GetProcessHeap () returned 0x650000 [0216.633] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666928 | out: hHeap=0x650000) returned 1 [0216.633] GetProcessHeap () returned 0x650000 [0216.633] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666938 | out: hHeap=0x650000) returned 1 [0216.633] GetProcessHeap () returned 0x650000 [0216.633] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666948 | out: hHeap=0x650000) returned 1 [0216.633] GetProcessHeap () returned 0x650000 [0216.633] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666958 | out: hHeap=0x650000) returned 1 [0216.633] GetProcessHeap () returned 0x650000 [0216.633] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666968 | out: hHeap=0x650000) returned 1 [0216.633] GetProcessHeap () returned 0x650000 [0216.633] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666978 | out: hHeap=0x650000) returned 1 [0216.633] GetProcessHeap () returned 0x650000 [0216.633] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666988 | out: hHeap=0x650000) returned 1 [0216.634] GetProcessHeap () returned 0x650000 [0216.634] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666998 | out: hHeap=0x650000) returned 1 [0216.634] GetProcessHeap () returned 0x650000 [0216.634] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6669a8 | out: hHeap=0x650000) returned 1 [0216.634] GetProcessHeap () returned 0x650000 [0216.634] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6669b8 | out: hHeap=0x650000) returned 1 [0216.634] GetProcessHeap () returned 0x650000 [0216.634] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6669c8 | out: hHeap=0x650000) returned 1 [0216.634] GetProcessHeap () returned 0x650000 [0216.634] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x6669d8 | out: hHeap=0x650000) returned 1 [0216.634] GetProcessHeap () returned 0x650000 [0216.634] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666a08 | out: hHeap=0x650000) returned 1 [0216.634] GetProcessHeap () returned 0x650000 [0216.634] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666a18 | out: hHeap=0x650000) returned 1 [0216.634] GetProcessHeap () returned 0x650000 [0216.634] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666a28 | out: hHeap=0x650000) returned 1 [0216.634] GetProcessHeap () returned 0x650000 [0216.634] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666a38 | out: hHeap=0x650000) returned 1 [0216.634] GetProcessHeap () returned 0x650000 [0216.634] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666a48 | out: hHeap=0x650000) returned 1 [0216.634] GetProcessHeap () returned 0x650000 [0216.634] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666a58 | out: hHeap=0x650000) returned 1 [0216.634] GetProcessHeap () returned 0x650000 [0216.634] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666a68 | out: hHeap=0x650000) returned 1 [0216.634] GetProcessHeap () returned 0x650000 [0216.634] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666a78 | out: hHeap=0x650000) returned 1 [0216.634] GetProcessHeap () returned 0x650000 [0216.634] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666a88 | out: hHeap=0x650000) returned 1 [0216.634] GetProcessHeap () returned 0x650000 [0216.634] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666a98 | out: hHeap=0x650000) returned 1 [0216.634] GetProcessHeap () returned 0x650000 [0216.634] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666aa8 | out: hHeap=0x650000) returned 1 [0216.634] GetProcessHeap () returned 0x650000 [0216.634] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666ab8 | out: hHeap=0x650000) returned 1 [0216.634] GetProcessHeap () returned 0x650000 [0216.634] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666ac8 | out: hHeap=0x650000) returned 1 [0216.634] GetProcessHeap () returned 0x650000 [0216.634] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666ad8 | out: hHeap=0x650000) returned 1 [0216.634] GetProcessHeap () returned 0x650000 [0216.634] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666ae8 | out: hHeap=0x650000) returned 1 [0216.634] GetProcessHeap () returned 0x650000 [0216.634] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666af8 | out: hHeap=0x650000) returned 1 [0216.634] GetProcessHeap () returned 0x650000 [0216.634] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666b08 | out: hHeap=0x650000) returned 1 [0216.635] GetProcessHeap () returned 0x650000 [0216.635] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666b18 | out: hHeap=0x650000) returned 1 [0216.635] GetProcessHeap () returned 0x650000 [0216.635] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666b28 | out: hHeap=0x650000) returned 1 [0216.635] GetProcessHeap () returned 0x650000 [0216.635] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666b38 | out: hHeap=0x650000) returned 1 [0216.635] GetProcessHeap () returned 0x650000 [0216.635] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666b48 | out: hHeap=0x650000) returned 1 [0216.635] GetProcessHeap () returned 0x650000 [0216.635] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666b58 | out: hHeap=0x650000) returned 1 [0216.635] GetProcessHeap () returned 0x650000 [0216.635] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666b68 | out: hHeap=0x650000) returned 1 [0216.635] GetProcessHeap () returned 0x650000 [0216.635] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666b78 | out: hHeap=0x650000) returned 1 [0216.635] GetProcessHeap () returned 0x650000 [0216.635] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666b88 | out: hHeap=0x650000) returned 1 [0216.635] GetProcessHeap () returned 0x650000 [0216.635] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666b98 | out: hHeap=0x650000) returned 1 [0216.635] GetProcessHeap () returned 0x650000 [0216.635] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666ba8 | out: hHeap=0x650000) returned 1 [0216.635] GetProcessHeap () returned 0x650000 [0216.635] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666bb8 | out: hHeap=0x650000) returned 1 [0216.635] GetProcessHeap () returned 0x650000 [0216.635] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666bc8 | out: hHeap=0x650000) returned 1 [0216.635] GetProcessHeap () returned 0x650000 [0216.635] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666bd8 | out: hHeap=0x650000) returned 1 [0216.635] GetProcessHeap () returned 0x650000 [0216.635] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666be8 | out: hHeap=0x650000) returned 1 [0216.635] GetProcessHeap () returned 0x650000 [0216.635] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666bf8 | out: hHeap=0x650000) returned 1 [0216.635] GetProcessHeap () returned 0x650000 [0216.635] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666c08 | out: hHeap=0x650000) returned 1 [0216.635] GetProcessHeap () returned 0x650000 [0216.635] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666c18 | out: hHeap=0x650000) returned 1 [0216.635] GetProcessHeap () returned 0x650000 [0216.635] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666c28 | out: hHeap=0x650000) returned 1 [0216.635] GetProcessHeap () returned 0x650000 [0216.635] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666c38 | out: hHeap=0x650000) returned 1 [0216.635] GetProcessHeap () returned 0x650000 [0216.635] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666c48 | out: hHeap=0x650000) returned 1 [0216.635] GetProcessHeap () returned 0x650000 [0216.635] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666c58 | out: hHeap=0x650000) returned 1 [0216.635] GetProcessHeap () returned 0x650000 [0216.635] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666c68 | out: hHeap=0x650000) returned 1 [0216.635] GetProcessHeap () returned 0x650000 [0216.636] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666c78 | out: hHeap=0x650000) returned 1 [0216.636] GetProcessHeap () returned 0x650000 [0216.636] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666c88 | out: hHeap=0x650000) returned 1 [0216.636] GetProcessHeap () returned 0x650000 [0216.636] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666c98 | out: hHeap=0x650000) returned 1 [0216.636] GetProcessHeap () returned 0x650000 [0216.636] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666ca8 | out: hHeap=0x650000) returned 1 [0216.636] GetProcessHeap () returned 0x650000 [0216.636] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666cb8 | out: hHeap=0x650000) returned 1 [0216.636] GetProcessHeap () returned 0x650000 [0216.636] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666cc8 | out: hHeap=0x650000) returned 1 [0216.636] GetProcessHeap () returned 0x650000 [0216.636] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666cd8 | out: hHeap=0x650000) returned 1 [0216.636] GetProcessHeap () returned 0x650000 [0216.636] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666ce8 | out: hHeap=0x650000) returned 1 [0216.636] GetProcessHeap () returned 0x650000 [0216.636] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666cf8 | out: hHeap=0x650000) returned 1 [0216.636] GetProcessHeap () returned 0x650000 [0216.636] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666d08 | out: hHeap=0x650000) returned 1 [0216.636] GetProcessHeap () returned 0x650000 [0216.636] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666d18 | out: hHeap=0x650000) returned 1 [0216.636] GetProcessHeap () returned 0x650000 [0216.636] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666d28 | out: hHeap=0x650000) returned 1 [0216.636] GetProcessHeap () returned 0x650000 [0216.636] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666d38 | out: hHeap=0x650000) returned 1 [0216.636] GetProcessHeap () returned 0x650000 [0216.636] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666d48 | out: hHeap=0x650000) returned 1 [0216.636] GetProcessHeap () returned 0x650000 [0216.636] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666d58 | out: hHeap=0x650000) returned 1 [0216.636] GetProcessHeap () returned 0x650000 [0216.636] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666d68 | out: hHeap=0x650000) returned 1 [0216.636] GetProcessHeap () returned 0x650000 [0216.636] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666d78 | out: hHeap=0x650000) returned 1 [0216.636] GetProcessHeap () returned 0x650000 [0216.636] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666d88 | out: hHeap=0x650000) returned 1 [0216.636] GetProcessHeap () returned 0x650000 [0216.636] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666d98 | out: hHeap=0x650000) returned 1 [0216.636] GetProcessHeap () returned 0x650000 [0216.636] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666da8 | out: hHeap=0x650000) returned 1 [0216.636] GetProcessHeap () returned 0x650000 [0216.636] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666db8 | out: hHeap=0x650000) returned 1 [0216.637] GetProcessHeap () returned 0x650000 [0216.637] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666dc8 | out: hHeap=0x650000) returned 1 [0216.637] GetProcessHeap () returned 0x650000 [0216.637] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666dd8 | out: hHeap=0x650000) returned 1 [0216.637] GetProcessHeap () returned 0x650000 [0216.637] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666e08 | out: hHeap=0x650000) returned 1 [0216.637] GetProcessHeap () returned 0x650000 [0216.637] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666e18 | out: hHeap=0x650000) returned 1 [0216.637] GetProcessHeap () returned 0x650000 [0216.637] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666e28 | out: hHeap=0x650000) returned 1 [0216.637] GetProcessHeap () returned 0x650000 [0216.637] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666e38 | out: hHeap=0x650000) returned 1 [0216.637] GetProcessHeap () returned 0x650000 [0216.637] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666e48 | out: hHeap=0x650000) returned 1 [0216.637] GetProcessHeap () returned 0x650000 [0216.637] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666e58 | out: hHeap=0x650000) returned 1 [0216.637] GetProcessHeap () returned 0x650000 [0216.637] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666e68 | out: hHeap=0x650000) returned 1 [0216.637] GetProcessHeap () returned 0x650000 [0216.637] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666e78 | out: hHeap=0x650000) returned 1 [0216.637] GetProcessHeap () returned 0x650000 [0216.637] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666e88 | out: hHeap=0x650000) returned 1 [0216.637] GetProcessHeap () returned 0x650000 [0216.637] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666e98 | out: hHeap=0x650000) returned 1 [0216.637] GetProcessHeap () returned 0x650000 [0216.637] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666ea8 | out: hHeap=0x650000) returned 1 [0216.637] GetProcessHeap () returned 0x650000 [0216.637] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666eb8 | out: hHeap=0x650000) returned 1 [0216.637] GetProcessHeap () returned 0x650000 [0216.637] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666ec8 | out: hHeap=0x650000) returned 1 [0216.637] exit (_Code=1) Thread: id = 177 os_tid = 0x6f8 Thread: id = 178 os_tid = 0x328 Thread: id = 179 os_tid = 0x6c0 Thread: id = 180 os_tid = 0x4ac Thread: id = 181 os_tid = 0x31c [0216.532] LocalAlloc (uFlags=0x40, uBytes=0x178) returned 0x6a9090 [0216.532] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x67c0e8 [0216.532] LocalAlloc (uFlags=0x0, uBytes=0xc) returned 0x680080 [0216.532] LocalAlloc (uFlags=0x40, uBytes=0x84) returned 0x693e30 [0216.532] LocalReAlloc (hMem=0x680080, uBytes=0x10, uFlags=0x2) returned 0x66bff8 Process: id = "20" image_name = "findstr.exe" filename = "c:\\windows\\syswow64\\findstr.exe" page_root = "0xc6dd000" os_pid = "0x320" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "15" os_parent_pid = "0x654" cmd_line = "findstr All" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ef13" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 103 os_tid = 0x760 Process: id = "21" image_name = "ctfmom.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ctfmom.exe" page_root = "0xbccf000" os_pid = "0x318" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "13" os_parent_pid = "0x614" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ef13" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 106 os_tid = 0x31c [0197.584] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x45fca4 | out: lpSystemTimeAsFileTime=0x45fca4*(dwLowDateTime=0x439877d0, dwHighDateTime=0x1d69aeb)) [0197.584] GetCurrentThreadId () returned 0x31c [0197.584] GetCurrentProcessId () returned 0x318 [0197.584] QueryPerformanceCounter (in: lpPerformanceCount=0x45fc9c | out: lpPerformanceCount=0x45fc9c*=10685837603) returned 1 [0197.598] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0197.598] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0197.598] GetLastError () returned 0x57 [0197.598] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0197.598] GetLastError () returned 0x57 [0197.598] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76a20000 [0197.600] GetProcAddress (hModule=0x76a20000, lpProcName="InitializeCriticalSectionEx") returned 0x76a34d28 [0197.600] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0197.600] GetLastError () returned 0x57 [0197.600] GetProcAddress (hModule=0x76a20000, lpProcName="FlsAlloc") returned 0x76a34f2b [0197.600] GetProcAddress (hModule=0x76a20000, lpProcName="FlsSetValue") returned 0x76a34208 [0197.600] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0197.600] GetLastError () returned 0x57 [0197.600] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0197.600] GetLastError () returned 0x57 [0197.600] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76a20000 [0197.600] GetProcAddress (hModule=0x76a20000, lpProcName="InitializeCriticalSectionEx") returned 0x76a34d28 [0197.601] GetProcessHeap () returned 0x1c0000 [0197.601] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0197.601] GetLastError () returned 0x57 [0197.601] GetProcAddress (hModule=0x76a20000, lpProcName="FlsAlloc") returned 0x76a34f2b [0197.601] GetLastError () returned 0x57 [0197.601] GetProcAddress (hModule=0x76a20000, lpProcName="FlsGetValue") returned 0x76a31252 [0197.601] GetProcAddress (hModule=0x76a20000, lpProcName="FlsSetValue") returned 0x76a34208 [0197.601] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x364) returned 0x1d1ef0 [0197.601] SetLastError (dwErrCode=0x57) [0197.601] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0xe00) returned 0x1d2260 [0197.603] GetStartupInfoW (in: lpStartupInfo=0x45fbdc | out: lpStartupInfo=0x45fbdc*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x8f0860, hStdOutput=0x3e766792, hStdError=0xfffffffe)) [0197.603] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0197.603] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0197.603] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0197.603] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe\" " [0197.603] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe\" " [0197.603] GetACP () returned 0x4e4 [0197.603] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x220) returned 0x1d3868 [0197.603] IsValidCodePage (CodePage=0x4e4) returned 1 [0197.603] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x45fbfc | out: lpCPInfo=0x45fbfc) returned 1 [0197.603] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x45f4c4 | out: lpCPInfo=0x45f4c4) returned 1 [0197.603] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x45fad8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0197.603] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x45fad8, cbMultiByte=256, lpWideCharStr=0x45f268, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ?\x8fĀ") returned 256 [0197.603] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ?\x8fĀ", cchSrc=256, lpCharType=0x45f4d8 | out: lpCharType=0x45f4d8) returned 1 [0197.603] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x45fad8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0197.603] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x45fad8, cbMultiByte=256, lpWideCharStr=0x45f218, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0197.603] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0197.603] GetLastError () returned 0x57 [0197.603] GetProcAddress (hModule=0x76a20000, lpProcName="LCMapStringEx") returned 0x76ab47f1 [0197.603] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0197.603] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchSrc=256, lpDestStr=0x45f008, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0197.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x45f9d8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿn\x1b¢>\x14üE", lpUsedDefaultChar=0x0) returned 256 [0197.604] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x45fad8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0197.604] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x45fad8, cbMultiByte=256, lpWideCharStr=0x45f238, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ?\x8fĀ") returned 256 [0197.604] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ?\x8fĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0197.604] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ?\x8fĀ", cchSrc=256, lpDestStr=0x45f028, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256 [0197.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x45f8d8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿn\x1b¢>\x14üE", lpUsedDefaultChar=0x0) returned 256 [0197.611] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x80) returned 0x1d07d8 [0197.611] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x45fa20, nSize=0x105 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ctfmom.exe")) returned 0x42 [0197.611] GetProcAddress (hModule=0x76a20000, lpProcName="AreFileApisANSI") returned 0x76ab40d1 [0197.611] AreFileApisANSI () returned 1 [0197.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 67 [0197.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe", cchWideChar=-1, lpMultiByteStr=0x91b9b8, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe", lpUsedDefaultChar=0x0) returned 67 [0197.612] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x4b) returned 0x1d0860 [0197.612] RtlInitializeSListHead (in: ListHead=0x91b780 | out: ListHead=0x91b780) [0197.612] GetLastError () returned 0x0 [0197.612] SetLastError (dwErrCode=0x0) [0197.612] GetEnvironmentStringsW () returned 0x1d3a90* [0197.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1409, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1409 [0197.612] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x581) returned 0x1d45a0 [0197.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1409, lpMultiByteStr=0x1d45a0, cbMultiByte=1409, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="=::=::\\", lpUsedDefaultChar=0x0) returned 1409 [0197.612] FreeEnvironmentStringsW (penv=0x1d3a90) returned 1 [0197.612] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x9c) returned 0x1d08b8 [0197.612] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x1f) returned 0x1d33f0 [0197.612] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x36) returned 0x1d4b30 [0197.612] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x37) returned 0x1d4b70 [0197.612] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x3c) returned 0x1d4bb0 [0197.612] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x31) returned 0x1d4bf8 [0197.612] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x17) returned 0x1d4c38 [0197.612] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x24) returned 0x1d4c58 [0197.612] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x14) returned 0x1d4c88 [0197.612] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0xd) returned 0x1d0b40 [0197.612] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x25) returned 0x1d4ca8 [0197.612] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x39) returned 0x1d4cd8 [0197.612] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x18) returned 0x1d4d20 [0197.612] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x17) returned 0x1d4d40 [0197.612] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0xe) returned 0x1d0b58 [0197.612] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x69) returned 0x1d4d60 [0197.612] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x3e) returned 0x1d4dd8 [0197.612] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x1b) returned 0x1d3418 [0197.612] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x1d) returned 0x1d3440 [0197.612] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x48) returned 0x1d4e20 [0197.612] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x12) returned 0x1d4e70 [0197.612] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x18) returned 0x1d4e90 [0197.612] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x1b) returned 0x1d3468 [0197.612] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x24) returned 0x1d4eb0 [0197.612] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x29) returned 0x1d4ee0 [0197.613] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x1e) returned 0x1d3490 [0197.613] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x41) returned 0x1d4f18 [0197.613] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x17) returned 0x1d4f68 [0197.613] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x14) returned 0x1d4f88 [0197.613] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0xf) returned 0x1d0b70 [0197.613] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x16) returned 0x1d4fa8 [0197.613] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x2a) returned 0x1d3a90 [0197.613] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x29) returned 0x1d3ac8 [0197.613] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x15) returned 0x1d4fc8 [0197.613] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x1e) returned 0x1d34b8 [0197.613] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x2a) returned 0x1d3b00 [0197.613] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x12) returned 0x1d3b38 [0197.613] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x18) returned 0x1d3b58 [0197.613] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x46) returned 0x1d3b78 [0197.613] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d45a0 | out: hHeap=0x1c0000) returned 1 [0197.613] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76a20000 [0197.613] GetProcAddress (hModule=0x76a20000, lpProcName="FlsAlloc") returned 0x76a34f2b [0197.613] GetProcAddress (hModule=0x76a20000, lpProcName="FlsFree") returned 0x76a3359f [0197.613] GetProcAddress (hModule=0x76a20000, lpProcName="FlsGetValue") returned 0x76a31252 [0197.613] GetProcAddress (hModule=0x76a20000, lpProcName="FlsSetValue") returned 0x76a34208 [0197.613] GetProcAddress (hModule=0x76a20000, lpProcName="InitializeCriticalSectionEx") returned 0x76a34d28 [0197.613] GetProcAddress (hModule=0x76a20000, lpProcName="InitOnceExecuteOnce") returned 0x76a4d627 [0197.613] GetProcAddress (hModule=0x76a20000, lpProcName="CreateEventExW") returned 0x76ab410b [0197.613] GetProcAddress (hModule=0x76a20000, lpProcName="CreateSemaphoreW") returned 0x76a4ca5a [0197.614] GetProcAddress (hModule=0x76a20000, lpProcName="CreateSemaphoreExW") returned 0x76ab4195 [0197.614] GetProcAddress (hModule=0x76a20000, lpProcName="CreateThreadpoolTimer") returned 0x76a4ee7e [0197.614] GetProcAddress (hModule=0x76a20000, lpProcName="SetThreadpoolTimer") returned 0x770b441c [0197.614] GetProcAddress (hModule=0x76a20000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x770dc50e [0197.614] GetProcAddress (hModule=0x76a20000, lpProcName="CloseThreadpoolTimer") returned 0x770dc381 [0197.614] GetProcAddress (hModule=0x76a20000, lpProcName="CreateThreadpoolWait") returned 0x76a4f088 [0197.614] GetProcAddress (hModule=0x76a20000, lpProcName="SetThreadpoolWait") returned 0x770c05d7 [0197.614] GetProcAddress (hModule=0x76a20000, lpProcName="CloseThreadpoolWait") returned 0x770dca24 [0197.614] GetProcAddress (hModule=0x76a20000, lpProcName="FlushProcessWriteBuffers") returned 0x77090b8c [0197.614] GetProcAddress (hModule=0x76a20000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7714fde8 [0197.614] GetProcAddress (hModule=0x76a20000, lpProcName="GetCurrentProcessorNumber") returned 0x770e1e1d [0197.614] GetProcAddress (hModule=0x76a20000, lpProcName="CreateSymbolicLinkW") returned 0x76aacd11 [0197.614] GetProcAddress (hModule=0x76a20000, lpProcName="GetCurrentPackageId") returned 0x0 [0197.614] GetProcAddress (hModule=0x76a20000, lpProcName="GetTickCount64") returned 0x76a4eee0 [0197.614] GetProcAddress (hModule=0x76a20000, lpProcName="GetFileInformationByHandleEx") returned 0x76a4c78f [0197.615] GetProcAddress (hModule=0x76a20000, lpProcName="SetFileInformationByHandle") returned 0x76a5cbfc [0197.615] GetProcAddress (hModule=0x76a20000, lpProcName="GetSystemTimePreciseAsFileTime") returned 0x0 [0197.615] GetProcAddress (hModule=0x76a20000, lpProcName="InitializeConditionVariable") returned 0x770a8456 [0197.615] GetProcAddress (hModule=0x76a20000, lpProcName="WakeConditionVariable") returned 0x77117de4 [0197.615] GetProcAddress (hModule=0x76a20000, lpProcName="WakeAllConditionVariable") returned 0x770d409d [0197.615] GetProcAddress (hModule=0x76a20000, lpProcName="SleepConditionVariableCS") returned 0x76ab4b32 [0197.615] GetProcAddress (hModule=0x76a20000, lpProcName="InitializeSRWLock") returned 0x770a8456 [0197.615] GetProcAddress (hModule=0x76a20000, lpProcName="AcquireSRWLockExclusive") returned 0x770a29f1 [0197.615] GetProcAddress (hModule=0x76a20000, lpProcName="TryAcquireSRWLockExclusive") returned 0x770b4892 [0197.615] GetProcAddress (hModule=0x76a20000, lpProcName="ReleaseSRWLockExclusive") returned 0x770a29ab [0197.615] GetProcAddress (hModule=0x76a20000, lpProcName="SleepConditionVariableSRW") returned 0x76ab4b74 [0197.615] GetProcAddress (hModule=0x76a20000, lpProcName="CreateThreadpoolWork") returned 0x76a4ee45 [0197.615] GetProcAddress (hModule=0x76a20000, lpProcName="SubmitThreadpoolWork") returned 0x770e8491 [0197.615] GetProcAddress (hModule=0x76a20000, lpProcName="CloseThreadpoolWork") returned 0x770dd8e2 [0197.616] GetProcAddress (hModule=0x76a20000, lpProcName="CompareStringEx") returned 0x76ab46b1 [0197.616] GetProcAddress (hModule=0x76a20000, lpProcName="GetLocaleInfoEx") returned 0x76ab4751 [0197.616] GetProcAddress (hModule=0x76a20000, lpProcName="LCMapStringEx") returned 0x76ab47f1 [0197.616] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x800) returned 0x1d3bc8 [0197.616] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0197.616] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x8ee1c1) returned 0x0 [0197.616] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x8) returned 0x1d0960 [0197.616] LoadLibraryExW (lpLibFileName="api-ms-win-core-string-l1-1-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0197.616] GetLastError () returned 0x57 [0197.616] GetProcAddress (hModule=0x76a20000, lpProcName="CompareStringEx") returned 0x76ab46b1 [0197.616] GetProcAddress (hModule=0x76a20000, lpProcName="EnumSystemLocalesEx") returned 0x76ab424f [0197.616] LoadLibraryExW (lpLibFileName="api-ms-win-core-datetime-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0197.616] GetLastError () returned 0x57 [0197.617] GetProcAddress (hModule=0x76a20000, lpProcName="GetDateFormatEx") returned 0x76ac6676 [0197.617] GetProcAddress (hModule=0x76a20000, lpProcName="GetLocaleInfoEx") returned 0x76ab4751 [0197.617] GetProcAddress (hModule=0x76a20000, lpProcName="GetTimeFormatEx") returned 0x76ac65f1 [0197.617] GetProcAddress (hModule=0x76a20000, lpProcName="GetUserDefaultLocaleName") returned 0x76ab47c1 [0197.617] GetProcAddress (hModule=0x76a20000, lpProcName="IsValidLocaleName") returned 0x76ab47e1 [0197.617] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-obsolete-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0197.617] GetLastError () returned 0x57 [0197.617] GetProcAddress (hModule=0x76a20000, lpProcName="LCIDToLocaleName") returned 0x76a5ced4 [0197.617] GetProcAddress (hModule=0x76a20000, lpProcName="LocaleNameToLCID") returned 0x76ab4801 [0197.617] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x20) returned 0x1d3698 [0197.617] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x2) returned 0x1cead0 [0197.617] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1cead0 | out: hHeap=0x1c0000) returned 1 [0197.617] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x2) returned 0x1cead0 [0197.617] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x8) returned 0x1d4818 [0197.617] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x18) returned 0x1d4828 [0197.617] GetLastError () returned 0x57 [0197.618] SetLastError (dwErrCode=0x57) [0197.618] GetLastError () returned 0x57 [0197.618] SetLastError (dwErrCode=0x57) [0197.618] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0xb8) returned 0x1d4848 [0197.618] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x6a6) returned 0x1d4fe8 [0197.618] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d4fe8 | out: hHeap=0x1c0000) returned 1 [0197.618] GetLastError () returned 0x57 [0197.618] SetLastError (dwErrCode=0x57) [0197.618] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x6) returned 0x1d4908 [0197.618] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x2) returned 0x1d4918 [0197.618] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x4) returned 0x1d4928 [0197.618] GetLastError () returned 0x57 [0197.618] SetLastError (dwErrCode=0x57) [0197.618] GetLastError () returned 0x57 [0197.618] SetLastError (dwErrCode=0x57) [0197.618] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0xb8) returned 0x1d4938 [0197.618] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x6a6) returned 0x1d4fe8 [0197.618] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d4fe8 | out: hHeap=0x1c0000) returned 1 [0197.618] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d4908 | out: hHeap=0x1c0000) returned 1 [0197.618] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d4848 | out: hHeap=0x1c0000) returned 1 [0197.618] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d4928 | out: hHeap=0x1c0000) returned 1 [0197.618] GetLastError () returned 0x57 [0197.618] SetLastError (dwErrCode=0x57) [0197.619] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x6) returned 0x1d4928 [0197.619] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x2) returned 0x1d4848 [0197.619] GetLastError () returned 0x57 [0197.619] SetLastError (dwErrCode=0x57) [0197.619] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x200) returned 0x1d4fe8 [0197.619] GetLastError () returned 0x57 [0197.619] SetLastError (dwErrCode=0x57) [0197.619] GetLastError () returned 0x57 [0197.619] SetLastError (dwErrCode=0x57) [0197.619] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x4) returned 0x1d4858 [0197.619] GetLastError () returned 0x57 [0197.619] SetLastError (dwErrCode=0x57) [0197.619] GetLastError () returned 0x57 [0197.619] SetLastError (dwErrCode=0x57) [0197.619] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0xb8) returned 0x1d49f8 [0197.619] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x6a6) returned 0x1d51f0 [0197.619] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d51f0 | out: hHeap=0x1c0000) returned 1 [0197.619] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d4928 | out: hHeap=0x1c0000) returned 1 [0197.619] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d4938 | out: hHeap=0x1c0000) returned 1 [0197.619] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d4858 | out: hHeap=0x1c0000) returned 1 [0197.619] GetLastError () returned 0x57 [0197.619] SetLastError (dwErrCode=0x57) [0197.619] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x6) returned 0x1d4ab8 [0197.619] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d4848 | out: hHeap=0x1c0000) returned 1 [0197.620] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d4918 | out: hHeap=0x1c0000) returned 1 [0197.620] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x8) returned 0x1d4ac8 [0197.620] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x8) returned 0x1d4ad8 [0197.620] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x8) returned 0x1d4ae8 [0197.620] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x50) returned 0x1d4848 [0197.620] GetStartupInfoW (in: lpStartupInfo=0x45fc40 | out: lpStartupInfo=0x45fc40*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0197.620] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x20) returned 0x1d36c0 [0197.620] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d36c0 | out: hHeap=0x1c0000) returned 1 [0197.620] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x8) returned 0x1d4af8 [0197.620] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x8) returned 0x1d4b08 [0197.621] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x38) returned 0x1d48a0 [0197.621] AreFileApisANSI () returned 1 [0197.621] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x1d4b38, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 67 [0197.621] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x86) returned 0x1d48e0 [0197.621] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x1d4b38, cbMultiByte=-1, lpWideCharStr=0x1d48e0, cchWideChar=67 | out: lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe") returned 67 [0197.621] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ctfmom.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x45f850, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x54 [0197.621] GetFileType (hFile=0x54) returned 0x1 [0197.621] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d48e0 | out: hHeap=0x1c0000) returned 1 [0197.621] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x8) returned 0x1d4b18 [0197.621] GetLastError () returned 0x0 [0197.621] SetLastError (dwErrCode=0x0) [0197.621] GetLastError () returned 0x0 [0197.621] SetLastError (dwErrCode=0x0) [0197.622] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0xb8) returned 0x1d48e0 [0197.622] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x6a6) returned 0x1d51f0 [0197.622] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d51f0 | out: hHeap=0x1c0000) returned 1 [0197.622] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d4ab8 | out: hHeap=0x1c0000) returned 1 [0197.622] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d49f8 | out: hHeap=0x1c0000) returned 1 [0197.622] GetLastError () returned 0x0 [0197.622] SetLastError (dwErrCode=0x0) [0197.622] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x6) returned 0x1d49a0 [0197.622] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x2) returned 0x1d49b0 [0197.622] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x4) returned 0x1d49c0 [0197.622] GetLastError () returned 0x0 [0197.622] SetLastError (dwErrCode=0x0) [0197.622] GetLastError () returned 0x0 [0197.622] SetLastError (dwErrCode=0x0) [0197.622] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0xb8) returned 0x1d49d0 [0197.622] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x6a6) returned 0x1d51f0 [0197.622] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d51f0 | out: hHeap=0x1c0000) returned 1 [0197.622] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d49a0 | out: hHeap=0x1c0000) returned 1 [0197.622] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d48e0 | out: hHeap=0x1c0000) returned 1 [0197.622] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d49c0 | out: hHeap=0x1c0000) returned 1 [0197.622] GetLastError () returned 0x0 [0197.622] SetLastError (dwErrCode=0x0) [0197.622] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x6) returned 0x1d49c0 [0197.622] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x2) returned 0x1d4a90 [0197.622] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0x4) returned 0x1d4aa0 [0197.622] GetLastError () returned 0x0 [0197.622] SetLastError (dwErrCode=0x0) [0197.622] GetLastError () returned 0x0 [0197.623] SetLastError (dwErrCode=0x0) [0197.623] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x8, Size=0xb8) returned 0x1d48e0 [0197.623] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x6a6) returned 0x1d51f0 [0197.623] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d51f0 | out: hHeap=0x1c0000) returned 1 [0197.623] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d49c0 | out: hHeap=0x1c0000) returned 1 [0197.623] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d49d0 | out: hHeap=0x1c0000) returned 1 [0197.623] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d4aa0 | out: hHeap=0x1c0000) returned 1 [0197.623] GetLastError () returned 0x0 [0197.623] SetLastError (dwErrCode=0x0) [0197.623] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x6) returned 0x1d49a0 [0197.623] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d4a90 | out: hHeap=0x1c0000) returned 1 [0197.623] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d49b0 | out: hHeap=0x1c0000) returned 1 [0197.623] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x8) returned 0x1d49b0 [0197.623] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", phkResult=0x45f80c | out: phkResult=0x45f80c*=0x5c) returned 0x0 [0197.623] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x2, phkResult=0x45f80c | out: phkResult=0x45f80c*=0x0) returned 0x5 [0197.624] RegCloseKey (hKey=0x0) returned 0x6 [0197.624] CloseHandle (hObject=0x54) returned 1 [0197.624] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d4b08 | out: hHeap=0x1c0000) returned 1 [0197.624] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d4af8 | out: hHeap=0x1c0000) returned 1 [0197.624] GetModuleHandleW (lpModuleName=0x0) returned 0x8e0000 [0197.624] GetModuleFileNameA (in: hModule=0x8e0000, lpFilename=0x45f928, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ctfmom.exe")) returned 0x42 [0197.624] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x20) returned 0x1d36e8 [0197.624] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d36e8 | out: hHeap=0x1c0000) returned 1 [0197.624] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x20) returned 0x1d36e8 [0197.624] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d36e8 | out: hHeap=0x1c0000) returned 1 [0197.624] CopyFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ctfmom.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe\\Microsoft\\ctfmom.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ctfmom.exe\\microsoft\\ctfmom.exe"), bFailIfExists=1) returned 0 [0197.625] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x60) returned 0x1d49c0 [0197.625] AreFileApisANSI () returned 1 [0197.625] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x1d49c0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 88 [0197.625] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0xb0) returned 0x1d51f0 [0197.625] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x1d49c0, cbMultiByte=-1, lpWideCharStr=0x1d51f0, cchWideChar=88 | out: lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe\\Microsoft\\ctfmom.exe") returned 88 [0197.625] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe\\Microsoft\\ctfmom.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ctfmom.exe\\microsoft\\ctfmom.exe"), dwDesiredAccess=0x80, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff [0197.625] GetLastError () returned 0x3 [0197.626] SetLastError (dwErrCode=0x3) [0197.626] GetLastError () returned 0x3 [0197.626] SetLastError (dwErrCode=0x3) [0197.626] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe\\Microsoft\\ctfmom.exe", nBufferLength=0x104, lpBuffer=0x45f61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe\\Microsoft\\ctfmom.exe", lpFilePart=0x0) returned 0x57 [0197.626] GetLastError () returned 0x3 [0197.626] SetLastError (dwErrCode=0x3) [0197.626] GetLastError () returned 0x3 [0197.626] SetLastError (dwErrCode=0x3) [0197.626] GetLastError () returned 0x3 [0197.626] SetLastError (dwErrCode=0x3) [0197.626] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d51f0 | out: hHeap=0x1c0000) returned 1 [0197.626] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d49c0 | out: hHeap=0x1c0000) returned 1 [0197.626] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x20) returned 0x1d36e8 [0197.626] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d36e8 | out: hHeap=0x1c0000) returned 1 [0197.626] CopyFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ctfmom.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe\\Microsoft\\ctfmom.exe\\ctfmom.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ctfmom.exe\\microsoft\\ctfmom.exe\\ctfmom.exe"), bFailIfExists=1) returned 0 [0197.626] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x2, phkResult=0x45f8f0 | out: phkResult=0x45f8f0*=0x0) returned 0x5 [0197.627] RegOpenKeyA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", phkResult=0x45f8f4 | out: phkResult=0x45f8f4*=0x54) returned 0x0 [0197.627] RegSetValueExA (in: hKey=0x54, lpValueName="ctfmom", Reserved=0x0, dwType=0x1, lpData="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe\\Microsoft\\ctfmom.exe\" /noshow\\ctfmom.exe\" /noshow", cbData=0x104 | out: lpData="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\ctfmom.exe\\Microsoft\\ctfmom.exe\" /noshow\\ctfmom.exe\" /noshow") returned 0x0 [0197.628] RegCloseKey (hKey=0x0) returned 0x6 [0197.628] RegCloseKey (hKey=0x54) returned 0x0 [0197.628] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x8) returned 0x1d4af8 [0197.628] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x8) returned 0x1d4b08 [0197.628] AreFileApisANSI () returned 1 [0197.628] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x916088, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0197.628] RtlAllocateHeap (HeapHandle=0x1c0000, Flags=0x0, Size=0x1e) returned 0x1d36e8 [0197.628] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x916088, cbMultiByte=-1, lpWideCharStr=0x1d36e8, cchWideChar=15 | out: lpWideCharStr="_CL_02f3a8c9sy") returned 15 [0197.628] CreateFileW (lpFileName="_CL_02f3a8c9sy" (normalized: "c:\\windows\\system32\\_cl_02f3a8c9sy"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x45f980, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0197.628] GetLastError () returned 0x2 [0197.628] GetLastError () returned 0x2 [0197.628] SetLastError (dwErrCode=0x2) [0197.628] GetLastError () returned 0x2 [0197.628] SetLastError (dwErrCode=0x2) [0197.628] GetLastError () returned 0x2 [0197.628] SetLastError (dwErrCode=0x2) [0197.628] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d36e8 | out: hHeap=0x1c0000) returned 1 [0197.629] GetModuleHandleW (lpModuleName=0x0) returned 0x8e0000 [0197.629] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d4848 | out: hHeap=0x1c0000) returned 1 [0197.629] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d4b18 | out: hHeap=0x1c0000) returned 1 [0197.629] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d49b0 | out: hHeap=0x1c0000) returned 1 [0197.629] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d4fe8 | out: hHeap=0x1c0000) returned 1 [0197.629] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d4828 | out: hHeap=0x1c0000) returned 1 [0197.629] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d4ac8 | out: hHeap=0x1c0000) returned 1 [0197.629] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d4ae8 | out: hHeap=0x1c0000) returned 1 [0197.629] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d4ad8 | out: hHeap=0x1c0000) returned 1 [0197.629] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d4818 | out: hHeap=0x1c0000) returned 1 [0197.629] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d0960 | out: hHeap=0x1c0000) returned 1 [0197.629] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d07d8 | out: hHeap=0x1c0000) returned 1 [0197.629] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d48a0 | out: hHeap=0x1c0000) returned 1 [0197.629] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d3bc8 | out: hHeap=0x1c0000) returned 1 [0197.629] LoadLibraryExW (lpLibFileName="api-ms-win-appmodel-runtime-l1-1-2", hFile=0x0, dwFlags=0x800) returned 0x0 [0197.629] GetLastError () returned 0x57 [0197.630] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x45fb10 | out: phModule=0x45fb10) returned 0 [0197.630] ExitProcess (uExitCode=0x1) [0197.630] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d49a0 | out: hHeap=0x1c0000) returned 1 [0197.630] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d48e0 | out: hHeap=0x1c0000) returned 1 [0197.630] HeapFree (in: hHeap=0x1c0000, dwFlags=0x0, lpMem=0x1d1ef0 | out: hHeap=0x1c0000) returned 1 Process: id = "22" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0xc8ea000" os_pid = "0x338" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "13" os_parent_pid = "0x614" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /c keys.util" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ef13" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 108 os_tid = 0x314 [0200.355] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x3ffba4 | out: lpSystemTimeAsFileTime=0x3ffba4*(dwLowDateTime=0x44c6c670, dwHighDateTime=0x1d69aeb)) [0200.355] GetCurrentProcessId () returned 0x338 [0200.355] GetCurrentThreadId () returned 0x314 [0200.355] GetTickCount () returned 0x113a2a6 [0200.355] QueryPerformanceCounter (in: lpPerformanceCount=0x3ffb9c | out: lpPerformanceCount=0x3ffb9c*=10961560849) returned 1 [0200.356] GetModuleHandleA (lpModuleName=0x0) returned 0x4a5a0000 [0200.356] __set_app_type (_Type=0x1) [0200.356] __p__fmode () returned 0x76a131f4 [0200.356] __p__commode () returned 0x76a131fc [0200.356] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a5c21a6) returned 0x0 [0200.357] __getmainargs (in: _Argc=0x4a5c4238, _Argv=0x4a5c4240, _Env=0x4a5c423c, _DoWildCard=0, _StartInfo=0x4a5c4140 | out: _Argc=0x4a5c4238, _Argv=0x4a5c4240, _Env=0x4a5c423c) returned 0 [0200.357] GetCurrentThreadId () returned 0x314 [0200.357] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x314) returned 0x60 [0200.357] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76a20000 [0200.357] GetProcAddress (hModule=0x76a20000, lpProcName="SetThreadUILanguage") returned 0x76a4a84f [0200.357] SetThreadUILanguage (LangId=0x0) returned 0x409 [0200.358] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0200.358] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ffb34 | out: phkResult=0x3ffb34*=0x0) returned 0x2 [0200.358] VirtualQuery (in: lpAddress=0x3ffb6b, lpBuffer=0x3ffb04, dwLength=0x1c | out: lpBuffer=0x3ffb04*(BaseAddress=0x3ff000, AllocationBase=0x300000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0200.358] VirtualQuery (in: lpAddress=0x300000, lpBuffer=0x3ffb04, dwLength=0x1c | out: lpBuffer=0x3ffb04*(BaseAddress=0x300000, AllocationBase=0x300000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0200.358] VirtualQuery (in: lpAddress=0x301000, lpBuffer=0x3ffb04, dwLength=0x1c | out: lpBuffer=0x3ffb04*(BaseAddress=0x301000, AllocationBase=0x300000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0200.358] VirtualQuery (in: lpAddress=0x303000, lpBuffer=0x3ffb04, dwLength=0x1c | out: lpBuffer=0x3ffb04*(BaseAddress=0x303000, AllocationBase=0x300000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0200.358] VirtualQuery (in: lpAddress=0x400000, lpBuffer=0x3ffb04, dwLength=0x1c | out: lpBuffer=0x3ffb04*(BaseAddress=0x400000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x170000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0200.358] GetConsoleOutputCP () returned 0x1b5 [0200.358] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a5c4260 | out: lpCPInfo=0x4a5c4260) returned 1 [0200.358] SetConsoleCtrlHandler (HandlerRoutine=0x4a5be72a, Add=1) returned 1 [0200.358] _get_osfhandle (_FileHandle=1) returned 0x7 [0200.358] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0200.359] _get_osfhandle (_FileHandle=1) returned 0x7 [0200.359] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a5c41ac | out: lpMode=0x4a5c41ac) returned 1 [0200.359] _get_osfhandle (_FileHandle=1) returned 0x7 [0200.359] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0200.359] _get_osfhandle (_FileHandle=0) returned 0x3 [0200.359] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a5c41b0 | out: lpMode=0x4a5c41b0) returned 1 [0200.359] _get_osfhandle (_FileHandle=0) returned 0x3 [0200.359] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0200.360] GetEnvironmentStringsW () returned 0x772080* [0200.360] GetProcessHeap () returned 0x760000 [0200.360] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0xb02) returned 0x772b90 [0200.360] FreeEnvironmentStringsW (penv=0x772080) returned 1 [0200.360] GetProcessHeap () returned 0x760000 [0200.360] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x4) returned 0x770cb8 [0200.360] GetEnvironmentStringsW () returned 0x772080* [0200.360] GetProcessHeap () returned 0x760000 [0200.360] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0xb02) returned 0x7736a0 [0200.360] FreeEnvironmentStringsW (penv=0x772080) returned 1 [0200.360] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x3feaa4 | out: phkResult=0x3feaa4*=0x68) returned 0x0 [0200.360] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x3feaac, lpData=0x3feab0, lpcbData=0x3feaa8*=0x1000 | out: lpType=0x3feaac*=0x0, lpData=0x3feab0*=0x0, lpcbData=0x3feaa8*=0x1000) returned 0x2 [0200.361] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x3feaac, lpData=0x3feab0, lpcbData=0x3feaa8*=0x1000 | out: lpType=0x3feaac*=0x4, lpData=0x3feab0*=0x1, lpcbData=0x3feaa8*=0x4) returned 0x0 [0200.361] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x3feaac, lpData=0x3feab0, lpcbData=0x3feaa8*=0x1000 | out: lpType=0x3feaac*=0x0, lpData=0x3feab0*=0x1, lpcbData=0x3feaa8*=0x1000) returned 0x2 [0200.361] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x3feaac, lpData=0x3feab0, lpcbData=0x3feaa8*=0x1000 | out: lpType=0x3feaac*=0x4, lpData=0x3feab0*=0x0, lpcbData=0x3feaa8*=0x4) returned 0x0 [0200.361] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x3feaac, lpData=0x3feab0, lpcbData=0x3feaa8*=0x1000 | out: lpType=0x3feaac*=0x4, lpData=0x3feab0*=0x40, lpcbData=0x3feaa8*=0x4) returned 0x0 [0200.361] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x3feaac, lpData=0x3feab0, lpcbData=0x3feaa8*=0x1000 | out: lpType=0x3feaac*=0x4, lpData=0x3feab0*=0x40, lpcbData=0x3feaa8*=0x4) returned 0x0 [0200.361] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x3feaac, lpData=0x3feab0, lpcbData=0x3feaa8*=0x1000 | out: lpType=0x3feaac*=0x0, lpData=0x3feab0*=0x40, lpcbData=0x3feaa8*=0x1000) returned 0x2 [0200.361] RegCloseKey (hKey=0x68) returned 0x0 [0200.361] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x3feaa4 | out: phkResult=0x3feaa4*=0x68) returned 0x0 [0200.361] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x3feaac, lpData=0x3feab0, lpcbData=0x3feaa8*=0x1000 | out: lpType=0x3feaac*=0x0, lpData=0x3feab0*=0x40, lpcbData=0x3feaa8*=0x1000) returned 0x2 [0200.361] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x3feaac, lpData=0x3feab0, lpcbData=0x3feaa8*=0x1000 | out: lpType=0x3feaac*=0x4, lpData=0x3feab0*=0x1, lpcbData=0x3feaa8*=0x4) returned 0x0 [0200.361] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x3feaac, lpData=0x3feab0, lpcbData=0x3feaa8*=0x1000 | out: lpType=0x3feaac*=0x0, lpData=0x3feab0*=0x1, lpcbData=0x3feaa8*=0x1000) returned 0x2 [0200.361] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x3feaac, lpData=0x3feab0, lpcbData=0x3feaa8*=0x1000 | out: lpType=0x3feaac*=0x4, lpData=0x3feab0*=0x0, lpcbData=0x3feaa8*=0x4) returned 0x0 [0200.361] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x3feaac, lpData=0x3feab0, lpcbData=0x3feaa8*=0x1000 | out: lpType=0x3feaac*=0x4, lpData=0x3feab0*=0x9, lpcbData=0x3feaa8*=0x4) returned 0x0 [0200.361] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x3feaac, lpData=0x3feab0, lpcbData=0x3feaa8*=0x1000 | out: lpType=0x3feaac*=0x4, lpData=0x3feab0*=0x9, lpcbData=0x3feaa8*=0x4) returned 0x0 [0200.361] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x3feaac, lpData=0x3feab0, lpcbData=0x3feaa8*=0x1000 | out: lpType=0x3feaac*=0x0, lpData=0x3feab0*=0x9, lpcbData=0x3feaa8*=0x1000) returned 0x2 [0200.361] RegCloseKey (hKey=0x68) returned 0x0 [0200.361] time (in: timer=0x0 | out: timer=0x0) returned 0x5f7aceb7 [0200.361] srand (_Seed=0x5f7aceb7) [0200.361] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c keys.util" [0200.361] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c keys.util" [0200.362] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a5c5260 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0200.362] GetProcessHeap () returned 0x760000 [0200.362] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x210) returned 0x772080 [0200.362] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x772088, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0200.362] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a5d0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0200.362] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a5d0640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0200.362] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a5d0640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0200.362] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0200.362] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0200.362] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0200.362] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0200.362] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0200.362] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0200.362] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0200.362] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0200.362] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0200.362] GetProcessHeap () returned 0x760000 [0200.362] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x772b90 | out: hHeap=0x760000) returned 1 [0200.363] GetEnvironmentStringsW () returned 0x772298* [0200.363] GetProcessHeap () returned 0x760000 [0200.363] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0xb1a) returned 0x774cd8 [0200.363] FreeEnvironmentStringsW (penv=0x772298) returned 1 [0200.363] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a5d0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0200.363] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a5d0640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0200.363] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0200.363] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0200.363] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0200.363] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0200.363] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0200.363] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0200.363] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0200.363] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0200.363] GetProcessHeap () returned 0x760000 [0200.363] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x30) returned 0x771f00 [0200.363] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x3ff870 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0200.363] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x104, lpBuffer=0x3ff870, lpFilePart=0x3ff86c | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x3ff86c*="system32") returned 0x13 [0200.363] GetFileAttributesW (lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0200.363] FindFirstFileW (in: lpFileName="C:\\Windows", lpFindFileData=0x3ff5ec | out: lpFindFileData=0x3ff5ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x775800 [0200.363] FindClose (in: hFindFile=0x775800 | out: hFindFile=0x775800) returned 1 [0200.364] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x3ff5ec | out: lpFindFileData=0x3ff5ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xefd85d60, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xefd85d60, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System32", cAlternateFileName="")) returned 0x760ff0 [0200.364] FindClose (in: hFindFile=0x760ff0 | out: hFindFile=0x760ff0) returned 1 [0200.364] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0200.364] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0200.364] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0200.364] GetProcessHeap () returned 0x760000 [0200.364] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x774cd8 | out: hHeap=0x760000) returned 1 [0200.364] GetEnvironmentStringsW () returned 0x7741b0* [0200.364] GetProcessHeap () returned 0x760000 [0200.364] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0xb4a) returned 0x774d08 [0200.364] FreeEnvironmentStringsW (penv=0x7741b0) returned 1 [0200.364] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a5c5260 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0200.364] GetProcessHeap () returned 0x760000 [0200.364] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x771f00 | out: hHeap=0x760000) returned 1 [0200.364] GetProcessHeap () returned 0x760000 [0200.364] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x400e) returned 0x775860 [0200.365] GetProcessHeap () returned 0x760000 [0200.365] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x20) returned 0x760830 [0200.365] GetProcessHeap () returned 0x760000 [0200.365] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x775860 | out: hHeap=0x760000) returned 1 [0200.365] GetConsoleOutputCP () returned 0x1b5 [0200.365] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a5c4260 | out: lpCPInfo=0x4a5c4260) returned 1 [0200.365] GetUserDefaultLCID () returned 0x409 [0200.365] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a5c4950, cchData=8 | out: lpLCData=":") returned 2 [0200.366] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x3ff9b0, cchData=128 | out: lpLCData="0") returned 2 [0200.366] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x3ff9b0, cchData=128 | out: lpLCData="0") returned 2 [0200.366] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x3ff9b0, cchData=128 | out: lpLCData="1") returned 2 [0200.366] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a5c4940, cchData=8 | out: lpLCData="/") returned 2 [0200.366] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a5c4d80, cchData=32 | out: lpLCData="Mon") returned 4 [0200.366] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a5c4d40, cchData=32 | out: lpLCData="Tue") returned 4 [0200.366] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a5c4d00, cchData=32 | out: lpLCData="Wed") returned 4 [0200.366] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a5c4cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0200.366] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a5c4c80, cchData=32 | out: lpLCData="Fri") returned 4 [0200.366] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a5c4c40, cchData=32 | out: lpLCData="Sat") returned 4 [0200.366] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a5c4c00, cchData=32 | out: lpLCData="Sun") returned 4 [0200.366] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a5c4930, cchData=8 | out: lpLCData=".") returned 2 [0200.366] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a5c4920, cchData=8 | out: lpLCData=",") returned 2 [0200.366] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0200.367] GetProcessHeap () returned 0x760000 [0200.367] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x20c) returned 0x760ff0 [0200.367] GetConsoleTitleW (in: lpConsoleTitle=0x760ff0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0200.367] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76a20000 [0200.367] GetProcAddress (hModule=0x76a20000, lpProcName="CopyFileExW") returned 0x76a53b92 [0200.368] GetProcAddress (hModule=0x76a20000, lpProcName="IsDebuggerPresent") returned 0x76a34a5d [0200.368] GetProcAddress (hModule=0x76a20000, lpProcName="SetConsoleInputExeNameW") returned 0x76a4a79d [0200.368] GetProcessHeap () returned 0x760000 [0200.368] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x400a) returned 0x775860 [0200.368] GetProcessHeap () returned 0x760000 [0200.368] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x775860 | out: hHeap=0x760000) returned 1 [0200.369] _wcsicmp (_String1="keys.util", _String2=")") returned 66 [0200.369] _wcsicmp (_String1="FOR", _String2="keys.util") returned -5 [0200.369] _wcsicmp (_String1="FOR/?", _String2="keys.util") returned -5 [0200.369] _wcsicmp (_String1="IF", _String2="keys.util") returned -2 [0200.369] _wcsicmp (_String1="IF/?", _String2="keys.util") returned -2 [0200.369] _wcsicmp (_String1="REM", _String2="keys.util") returned 7 [0200.369] _wcsicmp (_String1="REM/?", _String2="keys.util") returned 7 [0200.369] GetProcessHeap () returned 0x760000 [0200.369] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x58) returned 0x761208 [0200.369] GetProcessHeap () returned 0x760000 [0200.369] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x1c) returned 0x760858 [0200.370] GetConsoleTitleW (in: lpConsoleTitle=0x3ff6a8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0200.370] GetFileAttributesW (lpFileName="keys.util" (normalized: "c:\\windows\\system32\\keys.util")) returned 0xffffffff [0200.370] _wcsicmp (_String1="keys", _String2="DIR") returned 7 [0200.370] _wcsicmp (_String1="keys", _String2="ERASE") returned 6 [0200.370] _wcsicmp (_String1="keys", _String2="DEL") returned 7 [0200.370] _wcsicmp (_String1="keys", _String2="TYPE") returned -9 [0200.370] _wcsicmp (_String1="keys", _String2="COPY") returned 8 [0200.370] _wcsicmp (_String1="keys", _String2="CD") returned 8 [0200.370] _wcsicmp (_String1="keys", _String2="CHDIR") returned 8 [0200.370] _wcsicmp (_String1="keys", _String2="RENAME") returned -7 [0200.370] _wcsicmp (_String1="keys", _String2="REN") returned -7 [0200.370] _wcsicmp (_String1="keys", _String2="ECHO") returned 6 [0200.371] _wcsicmp (_String1="keys", _String2="SET") returned -8 [0200.371] _wcsicmp (_String1="keys", _String2="PAUSE") returned -5 [0200.371] _wcsicmp (_String1="keys", _String2="DATE") returned 7 [0200.371] _wcsicmp (_String1="keys", _String2="TIME") returned -9 [0200.371] _wcsicmp (_String1="keys", _String2="PROMPT") returned -5 [0200.371] _wcsicmp (_String1="keys", _String2="MD") returned -2 [0200.371] _wcsicmp (_String1="keys", _String2="MKDIR") returned -2 [0200.371] _wcsicmp (_String1="keys", _String2="RD") returned -7 [0200.371] _wcsicmp (_String1="keys", _String2="RMDIR") returned -7 [0200.371] _wcsicmp (_String1="keys", _String2="PATH") returned -5 [0200.371] _wcsicmp (_String1="keys", _String2="GOTO") returned 4 [0200.371] _wcsicmp (_String1="keys", _String2="SHIFT") returned -8 [0200.371] _wcsicmp (_String1="keys", _String2="CLS") returned 8 [0200.371] _wcsicmp (_String1="keys", _String2="CALL") returned 8 [0200.371] _wcsicmp (_String1="keys", _String2="VERIFY") returned -11 [0200.371] _wcsicmp (_String1="keys", _String2="VER") returned -11 [0200.371] _wcsicmp (_String1="keys", _String2="VOL") returned -11 [0200.371] _wcsicmp (_String1="keys", _String2="EXIT") returned 6 [0200.371] _wcsicmp (_String1="keys", _String2="SETLOCAL") returned -8 [0200.371] _wcsicmp (_String1="keys", _String2="ENDLOCAL") returned 6 [0200.371] _wcsicmp (_String1="keys", _String2="TITLE") returned -9 [0200.371] _wcsicmp (_String1="keys", _String2="START") returned -8 [0200.371] _wcsicmp (_String1="keys", _String2="DPATH") returned 7 [0200.371] _wcsicmp (_String1="keys", _String2="KEYS") returned 0 [0200.373] GetProcessHeap () returned 0x760000 [0200.373] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x1c) returned 0x760880 [0200.374] GetProcessHeap () returned 0x760000 [0200.374] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x20) returned 0x7608a8 [0200.374] GetProcessHeap () returned 0x760000 [0200.374] RtlReAllocateHeap (Heap=0x760000, Flags=0x0, Ptr=0x7608a8, Size=0x16) returned 0x761268 [0200.374] GetProcessHeap () returned 0x760000 [0200.374] RtlSizeHeap (HeapHandle=0x760000, Flags=0x0, MemoryPointer=0x761268) returned 0x16 [0200.374] GetProcessHeap () returned 0x760000 [0200.374] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x1e) returned 0x7608a8 [0200.374] GetProcessHeap () returned 0x760000 [0200.374] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x20) returned 0x7608d0 [0200.374] GetProcessHeap () returned 0x760000 [0200.374] RtlReAllocateHeap (Heap=0x760000, Flags=0x0, Ptr=0x7608d0, Size=0x16) returned 0x761288 [0200.374] GetProcessHeap () returned 0x760000 [0200.374] RtlSizeHeap (HeapHandle=0x760000, Flags=0x0, MemoryPointer=0x761288) returned 0x16 [0200.375] _wcsicmp (_String1=".util", _String2="ON") returned -65 [0200.375] _wcsicmp (_String1=".util", _String2="OFF") returned -65 [0200.375] _wcsicmp (_String1=".util", _String2="LIST") returned -62 [0200.375] _get_osfhandle (_FileHandle=2) returned 0xb [0200.375] GetFileType (hFile=0xb) returned 0x2 [0200.376] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0200.376] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x3ff5e8 | out: lpMode=0x3ff5e8) returned 1 [0200.376] _get_osfhandle (_FileHandle=2) returned 0xb [0200.376] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb, lpConsoleScreenBufferInfo=0x3ff61c | out: lpConsoleScreenBufferInfo=0x3ff61c) returned 1 [0200.376] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2329, dwLanguageId=0x0, lpBuffer=0x4a5d4640, nSize=0x2000, Arguments=0x0 | out: lpBuffer="An incorrect parameter was\r\nentered for the command.\r\n") returned 0x36 [0200.377] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2329, dwLanguageId=0x0, lpBuffer=0x4a5d4640, nSize=0x2000, Arguments=0x3ff65c | out: lpBuffer="An incorrect parameter was\r\nentered for the command.\r\n") returned 0x36 [0200.377] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4a5d4640*, nNumberOfCharsToWrite=0x36, lpNumberOfCharsWritten=0x3ff640, lpReserved=0x0 | out: lpBuffer=0x4a5d4640*, lpNumberOfCharsWritten=0x3ff640*=0x36) returned 1 [0200.378] _get_osfhandle (_FileHandle=1) returned 0x7 [0200.378] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0200.379] _get_osfhandle (_FileHandle=1) returned 0x7 [0200.379] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a5c41ac | out: lpMode=0x4a5c41ac) returned 1 [0200.379] _get_osfhandle (_FileHandle=0) returned 0x3 [0200.379] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a5c41b0 | out: lpMode=0x4a5c41b0) returned 1 [0200.379] SetConsoleInputExeNameW () returned 0x1 [0200.379] GetConsoleOutputCP () returned 0x1b5 [0200.379] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a5c4260 | out: lpCPInfo=0x4a5c4260) returned 1 [0200.379] SetThreadUILanguage (LangId=0x0) returned 0x409 [0200.379] exit (_Code=0) Process: id = "23" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x22124000" os_pid = "0x368" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "17" os_parent_pid = "0x1d4" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000d3ee" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 114 os_tid = 0x578 Thread: id = 115 os_tid = 0x560 Thread: id = 116 os_tid = 0x57c Thread: id = 117 os_tid = 0x530 Thread: id = 118 os_tid = 0x4b4 Thread: id = 119 os_tid = 0x4a0 Thread: id = 120 os_tid = 0x4d4 Thread: id = 121 os_tid = 0x780 Thread: id = 122 os_tid = 0x6f0 Thread: id = 123 os_tid = 0x6ac Thread: id = 124 os_tid = 0x698 Thread: id = 125 os_tid = 0x678 Thread: id = 126 os_tid = 0x670 Thread: id = 127 os_tid = 0x664 Thread: id = 128 os_tid = 0x658 Thread: id = 129 os_tid = 0x4a8 Thread: id = 130 os_tid = 0x64c Thread: id = 131 os_tid = 0x63c Thread: id = 132 os_tid = 0x638 Thread: id = 133 os_tid = 0x634 Thread: id = 134 os_tid = 0x624 Thread: id = 135 os_tid = 0x5b4 Thread: id = 136 os_tid = 0x484 Thread: id = 137 os_tid = 0x438 Thread: id = 138 os_tid = 0x430 Thread: id = 139 os_tid = 0x118 Thread: id = 140 os_tid = 0x298 Thread: id = 141 os_tid = 0x26c Thread: id = 142 os_tid = 0x220 Thread: id = 143 os_tid = 0x158 Thread: id = 144 os_tid = 0x124 Thread: id = 145 os_tid = 0x134 Thread: id = 146 os_tid = 0x3fc Thread: id = 147 os_tid = 0x3f8 Thread: id = 148 os_tid = 0x3e0 Thread: id = 149 os_tid = 0x3dc Thread: id = 150 os_tid = 0x384 Thread: id = 151 os_tid = 0x380 Thread: id = 152 os_tid = 0x37c Thread: id = 153 os_tid = 0x378 Thread: id = 154 os_tid = 0x374 Thread: id = 155 os_tid = 0x36c Thread: id = 156 os_tid = 0x7dc Thread: id = 157 os_tid = 0x798 Thread: id = 158 os_tid = 0x794 Thread: id = 159 os_tid = 0x790 Thread: id = 160 os_tid = 0x784 Thread: id = 161 os_tid = 0x720 Thread: id = 197 os_tid = 0x334 Thread: id = 198 os_tid = 0x570 Thread: id = 199 os_tid = 0x6c4 Thread: id = 200 os_tid = 0x718 Thread: id = 201 os_tid = 0x6e4 Thread: id = 202 os_tid = 0x708 Thread: id = 203 os_tid = 0x710 Thread: id = 204 os_tid = 0x278 Thread: id = 205 os_tid = 0x528 Thread: id = 206 os_tid = 0x680 Thread: id = 208 os_tid = 0x728 Thread: id = 209 os_tid = 0x724 Process: id = "24" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0xbfb3000" os_pid = "0x5dc" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "23" os_parent_pid = "0x258" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:0002cd50" [0xc000000f] Thread: id = 163 os_tid = 0x738 Thread: id = 164 os_tid = 0x73c Thread: id = 165 os_tid = 0x768 Thread: id = 166 os_tid = 0x764 Thread: id = 167 os_tid = 0x750 Thread: id = 168 os_tid = 0x5b8 Thread: id = 169 os_tid = 0x76c Thread: id = 171 os_tid = 0x500 Thread: id = 175 os_tid = 0x550 Thread: id = 207 os_tid = 0x544 Thread: id = 210 os_tid = 0x318